Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,336 results · page 7 of 267
Oct 21, 2026WholesaleX: Does not check that a stored account confirmation code is set before comparing it with the one supplied in a requestCVE-2026-111955 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login.
- Product
- WholesaleX
- Fixed in
- 3.0.9
- What to do
- Update WholesaleX to 3.0.9 or newer.
Oct 21, 2026Pricing Table: Does not perform authorisation checksCVE-2026-111947 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to other users.
- Product
- Pricing Table
- Fixed in
- 4.1.3
- What to do
- Update Pricing Table to 4.1.3 or newer.
Oct 21, 2026AI Engine: Does not check that the caller is allowed to edit the targeted object before updating its title and excerptCVE-2026-110982 · WordPress plugins & themes · reported by WPScanMedium 4.9
The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as navigation menus, block templates, global styles and WooCommerce coupons.
- Product
- AI Engine
- Fixed in
- 3.8.6
- What to do
- Update AI Engine to 3.8.6 or newer.
Oct 21, 2026WPZOOM Portfolio Lite: Does not check that a user is allowed to edit a post before changing its type and orderCVE-2026-110514 · WordPress plugins & themes · reported by WPScanMedium 4.9
The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their original listings and URLs.
- Product
- WPZOOM Portfolio Lite
- Fixed in
- 1.4.34
- What to do
- Update WPZOOM Portfolio Lite to 1.4.34 or newer.
Oct 21, 2026Productive Commerce: Does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area pageCVE-2026-109926 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin before 1.1.49 already installed on the site.
- Product
- Productive Commerce
- Fixed in
- 1.1.49
- What to do
- Update Productive Commerce to 1.1.49 or newer.
Oct 21, 2026SmartyParcel: Does not perform authorisation checksCVE-2026-107789 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.
- Product
- SmartyParcel
- Fixed in
- 1.23.4
- What to do
- Update SmartyParcel to 1.23.4 or newer.
Oct 21, 2026SmartyParcel: Does not perform authorisation checksCVE-2026-107788 · WordPress plugins & themes · reported by WPScanMedium 4.3
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.
- Product
- SmartyParcel
- Fixed in
- 1.23.4
- What to do
- Update SmartyParcel to 1.23.4 or newer.
Oct 21, 2026Backup and Staging by WP Time Capsule: Does not perform capability or nonce checks on the handler that deploys a staging site to the live siteCVE-2026-107237 · WordPress plugins & themes · reported by WPScanHigh 8.2
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.
- Product
- Backup and Staging by WP Time Capsule
- Fixed in
- 1.22.28
- What to do
- Update Backup and Staging by WP Time Capsule to 1.22.28 or newer.
Oct 21, 2026Moloni: Does not perform capability or nonce checks on several of its authenticated AJAX actionsCVE-2026-106932 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.
- Product
- Moloni
- Fixed in
- 5.0.14
- What to do
- Update Moloni to 5.0.14 or newer.
Oct 21, 2026Booking Package: Does not perform authorization checks before returning calendar-account configuration in a responseCVE-2026-105999 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.
- Product
- Booking Package
- Fixed in
- 1.7.31
- What to do
- Update Booking Package to 1.7.31 or newer.
Oct 21, 2026Booking Package: Does not perform any authorization or validity check before resetting its premium subscription stateCVE-2026-105998 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.
- Product
- Booking Package
- Fixed in
- 1.7.31
- What to do
- Update Booking Package to 1.7.31 or newer.
Oct 21, 2026Falang multilanguage for: Does not perform a capability checkCVE-2026-105262 · WordPress plugins & themes · reported by WPScanHigh 8
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.
- Product
- Falang multilanguage for
- Fixed in
- 1.4.6
- What to do
- Update Falang multilanguage for to 1.4.6 or newer.
Oct 20, 2026Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is belCVE-2026-114118 · Other software · vyperlang · reported by VulnCheckMedium 6.3
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 20, 2026Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files byCVE-2026-114096 · Other software · jelmer · reported by VulnCheckHigh 7.3
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.
- Product
- dulwich
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 20, 2026Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.CVE-2026-114092 · Other software · triggerdotdev · reported by VulnCheckHigh 8.3
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.
- Product
- trigger.dev
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dieCVE-2026-114051 · Other software · vllm-project · reported by VulnCheckHigh 7.1
vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 20, 2026vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes.CVE-2026-114050 · Other software · vllm-project · reported by VulnCheckHigh 7.1
vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 20, 2026IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking.CVE-2026-76587 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.
- Product
- Planning Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64.CVE-2026-113868 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 20, 2026A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsCVE-2026-92843 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the normal handshake, before certificate verification completes.
- Product
- Eclipse ThreadX - NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _rCVE-2026-90800 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
- Product
- Apache CouchDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Oct 20, 2026json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literaCVE-2026-113602 · Other software · json-smart · reported by VulnCheckMedium 6.9
json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating parser differentials with downstream parsers like Jackson or Gson.
- Product
- json-smart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads.CVE-2026-92454 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.8
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which `GX_SOFTWARE_DECODER_SUPPORT` is enabled.
- Product
- Eclipse ThreadX - GUIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The GUIX binary resource loader never checks that a font page's glyph range is well formed.CVE-2026-91189 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.1
The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring `first_glyph > last_glyph` makes `last - first + 1` underflow to a very large unsigned count. That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.
- Product
- Eclipse ThreadX - GUIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthCVE-2026-80353 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.
- Product
- Apache Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code executioCVE-2026-43856 · Other software · Advantech · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4High 8.6
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.
- Product
- ADAM-3600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvantech.comcsa.gov.sg
Oct 20, 2026The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it.CVE-2026-112071 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aMedium 6.9
The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.
- Product
- Extension "TYPO3 Shop by coding.ms"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget.CVE-2026-112070 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aMedium 5.3
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
- Product
- Extension "Analytics"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The backend module does not check whether a backend user has access to the requested site.CVE-2026-112068 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aMedium 5.3
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
- Product
- Extension "Analytics"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page.CVE-2026-112065 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aMedium 5.3
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.
- Product
- Extension "sgalinski Cookie Consent"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A failure has been identified in the SNS during dynamic data files signature check.CVE-2026-113469 · Other software · Stormshield · reported by cert@airbus.comHigh 7.5
A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.
- Product
- Stormshield Network Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.stormshield.eu
Oct 20, 2026Easy Property Listings: Does not perform authorisation checks on several of its contact-management read AJAX actionsCVE-2026-96903 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.
- Product
- Easy Property Listings
- Fixed in
- 3.5.27
- What to do
- Update Easy Property Listings to 3.5.27 or newer.
Oct 19, 2026Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial oCVE-2026-17518 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.2
Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026An out-of-bounds write issue was addressed with improved bounds checking.CVE-2026-86981 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 19, 2026A privacy issue was addressed with improved checks.CVE-2026-86979 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026An out-of-bounds read was addressed with improved bounds checking.CVE-2026-86975 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected process termination.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 19, 2026An out-of-bounds read was addressed with improved bounds checking.CVE-2026-86957 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in wireless proximity may be able to cause unexpected system termination.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 19, 2026An out-of-bounds write issue was addressed with improved bounds checking.CVE-2026-86953 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.6
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An attacker in physical proximity may be able to cause a denial-of-service.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 19, 2026An out-of-bounds write issue was addressed with improved bounds checking.CVE-2026-86944 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 19, 2026An out-of-bounds write issue was addressed with improved bounds checking.CVE-2026-86918 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 19, 2026An authorization issue was addressed with improved entitlement checks.CVE-2026-86907 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.4
An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app with admin privileges may be able to modify the System Keychain.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 19, 2026An out-of-bounds write issue was addressed with improved bounds checking.CVE-2026-84613 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in radio range may be able to cause unexpected system termination.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 19, 2026A logic issue was addressed with improved checks.CVE-2026-84579 · Computers, phones & browsers · Apple · reported by product-security@apple.com
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Opening a file referencing a network share may lead to unexpected software execution.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 19, 2026The issue was addressed with additional app bundle integrity checks.CVE-2026-28854 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Golden Gate 27. A maliciously modified app may not be prevented from launching.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026The issue was addressed with improved checks.CVE-2026-28853 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 19, 2026Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive whiCVE-2026-112777 · Other software · craftcms · reported by VulnCheckHigh 8.7
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 19, 2026Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and rCVE-2026-112768 · Other software · parse-community · reported by VulnCheckMedium 6.9
Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 19, 2026docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=TruCVE-2026-112304 · Other software · Mindee · reported by VulnCheckHigh 7.7
docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading process's privileges on torch releases before 2.6.
- Product
- docTR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-qCVE-2026-109432 · Other software · Camunda · reported by VulnCheckCritical 9.3
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.
- Product
- Camunda 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeant.aidocs.camunda.org
Oct 19, 2026Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows autheCVE-2026-109431 · Other software · Camunda · reported by VulnCheckHigh 8.6
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Using only a known object ID, attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment to read or download task attachments and comments and to permanently delete task attachments.
- Product
- Camunda 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeant.aidocs.camunda.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.