Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,156 results · page 7 of 64
Mar 25, 2026A buffer overflow vulnerability in the dgiot binary in LSC Smart Indoor IP Camera V7.6.32.CVE-2024-51347 · Other software · reported by MITREHigh 7.2
A buffer overflow vulnerability in the dgiot binary in LSC Smart Indoor IP Camera V7.6.32. The flaw exists in the handling of the Time Zone (TZ) parameter within the ONVIF configuration interface. The time zone (TZ) parameter does not have its length properly validated before being copied into a fixed-size buffer using the insecure strcpy function.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Smart Custom Fields: Unauthorized access of dataCVE-2026-4066 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 5.0.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to read private and draft post content from other authors via the smart-cf-relational-posts-search AJAX action. The function queries posts with post_status=any and returns full WP_Post objects including post_content, but only checks the generic edit_posts capability instead of verifying whether the requesting user has permission to read each individual post.
- Product
- Smart Custom Fields
- Affected
- up to 5.0.6
- What to do
- Affects up to 5.0.6. Update Smart Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 21, 2026Smarter Analytics: Unauthorized accessCVE-2026-3570 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Smarter Analytics plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0. This is due to missing authentication and capability checks on the configuration reset functionality in the global scope of smarter-analytics.php. This makes it possible for unauthenticated attackers to reset all plugin configuration and delete all per-page/per-post analytics settings via the 'reset' parameter.
- Product
- Smarter Analytics
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Smarter Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 17, 2026NULL Pointer Dereference vulnerability in Softing Industrial Automation GmbH smartLink SW-HT (Webserver modules) allows HTTP DoS.This issue affects smartLink SWCVE-2025-13406 · Other software · Softing · reported by 10de8ef9-5c89-4b17-8228-e97b74acf4bdMedium 6.8
NULL Pointer Dereference vulnerability in Softing Industrial Automation GmbH smartLink SW-HT (Webserver modules) allows HTTP DoS.This issue affects smartLink SW-HT: 1.43.
- Product
- smartLink SW-HT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordindustrial.softing.comindustrial.softing.com
Mar 16, 2026A weakness has been identified in i-SENS SmartLog App up to 2.6.8 on Android.CVE-2026-4216 · Other software · i-SENS · reported by VulDBLow 1.9
A weakness has been identified in i-SENS SmartLog App up to 2.6.8 on Android. This affects an unknown function of the component air.SmartLog.android. This manipulation causes hard-coded credentials. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor explains: "The function referenced in the report currently exists in our deployed system. It is related to a developer mode used during the configuration process for Bluetooth pairing between the blood glucose meter and the SmartLog application. This function is intended for configuration purposes related to device integration and testing. (...) [I]n a future application update, we plan to review measures to either remove the developer mode function or restrict access to it."
- Product
- SmartLog App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilege.CVE-2026-21005 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.1
Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilege.
- Product
- Smart Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Mar 16, 2026Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service.CVE-2026-21004 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.9
Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service.
- Product
- Smart Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Mar 16, 2026Authentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote attackers to trigger privileged functions.CVE-2026-20999 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.1
Authentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote attackers to trigger privileged functions.
- Product
- Smart Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Mar 16, 2026Improper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication.CVE-2026-20998 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.1
Improper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication.
- Product
- Smart Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Mar 16, 2026Improper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15 allows remote attackers to potentially bypass authentication.CVE-2026-20997 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Improper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15 allows remote attackers to potentially bypass authentication.
- Product
- Smart Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Mar 16, 2026Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.69.15 allows remote attackers to configure a downgraded scheme for authentCVE-2026-20996 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.1
Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.69.15 allows remote attackers to configure a downgraded scheme for authentication.
- Product
- Smart Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Mar 16, 2026Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a specific configuration.CVE-2026-20995 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a specific configuration.
- Product
- Smart Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Mar 16, 2026Heap-based buffer overflow vulnerability in Softing Industrial Automation GmbH smartLink SW-PN and smartLink SW-HT (Webserver modules) allows overflow buffers.TCVE-2025-10685 · Other software · Softing · reported by 10de8ef9-5c89-4b17-8228-e97b74acf4bdHigh 7.7
Heap-based buffer overflow vulnerability in Softing Industrial Automation GmbH smartLink SW-PN and smartLink SW-HT (Webserver modules) allows overflow buffers.This issue affects: smartLink SW-PN: through 1.03 smartLink SW-HT: through 1.42
- Product
- smartLink SW-PN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordindustrial.softing.comindustrial.softing.com
Mar 16, 2026Global file reads caused by improper URL checks in webserver in Softing Industrial Automation GmbH smartLinks on docker (filesystem modules) allows file access.CVE-2025-10461 · Other software · Softing · reported by 10de8ef9-5c89-4b17-8228-e97b74acf4bdMedium 5.3
Global file reads caused by improper URL checks in webserver in Softing Industrial Automation GmbH smartLinks on docker (filesystem modules) allows file access. This issue affects smartLink SW-HT: through 1.42 smartLink SW-PN: through 1.03.
- Product
- smartLink SW-HT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordindustrial.softing.comindustrial.softing.com
Mar 13, 2026WPC Smart Wishlist for WooCommerce: Missing AuthorizationCVE-2026-32407 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPClever WPC Smart Wishlist for WooCommerce woo-smart-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Smart Wishlist for WooCommerce: from n/a through <= 5.0.8.
- Product
- WPC Smart Wishlist for WooCommerce
- Affected
- up to 5.0.8
- What to do
- Affects up to 5.0.8. Update WPC Smart Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026SmartFix: Missing AuthorizationCVE-2026-32391 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in linethemes SmartFix smartfix allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartFix: from n/a through < 1.2.4.
- Product
- SmartFix
- What to do
- Update SmartFix to the newest version.
Mar 12, 2026soroban-poseidon provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts.CVE-2026-32129 · Other software · stellar · reported by GitHubHigh 8.7
soroban-poseidon provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts. Poseidon V1 (PoseidonSponge) accepts variable-length inputs without injective padding. When a caller provides fewer inputs than the sponge rate (inputs.len() < T - 1), unused rate positions are implicitly zero-filled. This allows trivial hash collisions: for any input vector [m1, ..., mk] hashed with a sponge of rate > k, hash([m1, ..., mk]) equals hash([m1, ..., mk, 0]) because both produce identical pre-permutation states. This affects any use of PoseidonSponge or poseidon_hash where the number of inputs is less than T - 1 (e.g., hashing 1 input with T=3). Poseidon2 (Poseidon2Sponge) is not affected.
- Product
- rs-soroban-poseidon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026A potential divide by zero vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local authenticated user to causCVE-2026-1653 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.8
A potential divide by zero vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local authenticated user to cause a Windows blue screen error.
- Product
- Smart Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026A potential buffer overflow vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local authenticated user to corCVE-2026-1652 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.9
A potential buffer overflow vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local authenticated user to corrupt memory and cause a Windows blue screen error.
- Product
- Smart Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Open Forms allows users create and publish smart forms.CVE-2026-28803 · Other software · open-formulieren · reported by GitHubMedium 6.5
Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-link to start the cosign flow. The submission reference is communicated so that the user can retrieve the submission to be cosigned. Attackers can guess a code or modify the received code to look up arbitrary submissions, after logging in (with DigiD/eHerkenning/... depending on form configuration). This vulnerability is fixed in 3.3.13 and 3.4.5.
- Product
- open-forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2026A flaw has been found in 1024-lab/lab1024 SmartAdmin up to 3.29.CVE-2026-3725 · Other software · 1024-lab · reported by VulDBLow 2.1
A flaw has been found in 1024-lab/lab1024 SmartAdmin up to 3.29. Affected by this issue is the function freemarkerResolverContent of the file sa-base/src/main/java/net/lab1024/sa/base/module/support/mail/MailService.java of the component FreeMarker Template Handler. Executing a manipulation of the argument template_content can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SmartAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2026A weakness has been identified in 1024-lab/lab1024 SmartAdmin up to 3.29.CVE-2026-3721 · Other software · 1024-lab · reported by VulDBLow 2
A weakness has been identified in 1024-lab/lab1024 SmartAdmin up to 3.29. The affected element is an unknown function of the file sa-base/src/main/java/net/lab1024/sa/base/module/support/helpdoc/domain/form/HelpDocAddForm.java of the component Help Documentation Module. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SmartAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2026A security flaw has been discovered in 1024-lab/lab1024 SmartAdmin up to 3.29.CVE-2026-3720 · Other software · 1024-lab · reported by VulDBLow 2
A security flaw has been discovered in 1024-lab/lab1024 SmartAdmin up to 3.29. Impacted is an unknown function of the file smart-admin-web-javascript/src/views/business/oa/notice/components/notice-form-drawer.vue of the component Notice Module. The manipulation results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SmartAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026smart SEO: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28117 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes smart SEO smartSEO allows PHP Local File Inclusion.This issue affects smart SEO: from n/a through <= 2.9.
- Product
- smart SEO
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update smart SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 4, 2026A shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a specially crafted UDP datCVE-2026-26478 · Other software · Mobvoi · reported by MITRECritical 9.8
A shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a specially crafted UDP datagram and execute arbitrary shell code as the root account.
- Product
- Tichome Mini Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comweb.archive.org
Mar 2, 2026The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certifiCVE-2025-30042 · Other software · CGM · reported by cvd@cert.plCritical 9
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage.CVE-2025-15509 · Other software · vivo · reported by security@vivo.comHigh 7.1
The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage.
- Product
- SmartRemote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expiratioCVE-2026-26342 · Other software · Tattile s.r.l. · reported by VulnCheckHigh 8.7
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expiration. An attacker who obtains a valid token (for example via interception, log exposure, or token reuse on a shared system) can continue to authenticate to the management interface until the token is revoked, enabling unauthorized access to device functions and data.
- Product
- Smart+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtattile.comvulncheck.com
Feb 24, 2026Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during instaCVE-2026-26341 · Other software · Tattile s.r.l. · reported by VulnCheckCritical 9.3
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning. An attacker who can reach the management interface can authenticate using the default credentials and gain administrative access, enabling unauthorized access to device configuration and data.
- Product
- Smart+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtattile.comvulncheck.com
Feb 24, 2026Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication.CVE-2026-26340 · Other software · Tattile s.r.l. · reported by VulnCheckHigh 8.7
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of surveillance data.
- Product
- Smart+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtattile.comvulncheck.com
Feb 23, 2026A flaw has been found in ShuoRen Smart Heating Integrated Management Platform 1.0.0.CVE-2026-3025 · Other software · ShuoRen · reported by VulDBMedium 5.5
A flaw has been found in ShuoRen Smart Heating Integrated Management Platform 1.0.0. Affected by this vulnerability is an unknown functionality of the file /MP/Service/Webservice/ExampleNodeService.asmx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart Heating Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability was determined in a466350665 Smart-SSO up to 2.1.1.CVE-2026-2972 · Other software · a466350665 · reported by VulDBLow 1.9
A vulnerability was determined in a466350665 Smart-SSO up to 2.1.1. This affects the function Save of the file smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/admin/UserController.java of the component Role Edit Page. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart-SSO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability was found in a466350665 Smart-SSO up to 2.1.1.CVE-2026-2971 · Other software · a466350665 · reported by VulDBLow 2.1
A vulnerability was found in a466350665 Smart-SSO up to 2.1.1. Affected by this issue is some unknown functionality of the file smart-sso-server/src/main/resources/templates/login.html of the component Login. Performing a manipulation of the argument redirectUri results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart-SSO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026NoviSmart CMS contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the RefeCVE-2019-25439 · Other software · Novismart · reported by VulnCheckHigh 8.8
NoviSmart CMS contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the Referer HTTP header field. Attackers can craft requests with time-based SQL injection payloads in the Referer header to extract sensitive database information or cause denial of service.
- Product
- NoviSmart CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Feb 20, 2026PixelYourSite – Your smart PIXEL (TAG) Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27072 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager pixelyoursite allows Stored XSS.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through <= 11.2.0.1.
- Product
- PixelYourSite – Your smart PIXEL (TAG) Manager
- Affected
- up to 11.2.0.1
- What to do
- Affects up to 11.2.0.1. Update PixelYourSite – Your smart PIXEL (TAG) Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to seCVE-2026-22885 · Other software · EnOcean Edge Inc · reported by ics-cert@hq.dhs.govLow 3.7
A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in a memory leak from the program's memory.
- Product
- SmartServer IoT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordenoceanwiki.atlassian.netenoceanwiki.atlassian.net
Feb 20, 2026A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to seCVE-2026-20761 · Other software · EnOcean Edge Inc · reported by ics-cert@hq.dhs.govHigh 8.1
A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in arbitrary OS command execution on the device.
- Product
- SmartServer IoT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordenoceanwiki.atlassian.netenoceanwiki.atlassian.net
Feb 19, 2026A weakness has been identified in Fujian Smart Integrated Management Platform System up to 7.5.CVE-2026-2821 · Other software · Fujian · reported by VulDBMedium 5.5
A weakness has been identified in Fujian Smart Integrated Management Platform System up to 7.5. Impacted is an unknown function of the file /Module/CRXT/Controller/XCamera.ashx. This manipulation of the argument ChannelName causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
- Product
- Smart Integrated Management Platform System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026A security flaw has been discovered in Fujian Smart Integrated Management Platform System up to 7.5.CVE-2026-2820 · Other software · Fujian · reported by VulDBMedium 5.5
A security flaw has been discovered in Fujian Smart Integrated Management Platform System up to 7.5. This issue affects some unknown processing of the file /Module/CRXT/Controller/XAccessPermissionPlus.ashx. The manipulation of the argument DeviceIDS results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
- Product
- Smart Integrated Management Platform System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Penci AI SmartContent Creator: Missing AuthorizationCVE-2026-27055 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PenciDesign Penci AI SmartContent Creator penci-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Penci AI SmartContent Creator: from n/a through <= 2.0.
- Product
- Penci AI SmartContent Creator
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Penci AI SmartContent Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Smart Auto Upload Images: Server-Side Request Forgery (SSRF)CVE-2026-23803 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Burhan Nasir Smart Auto Upload Images smart-auto-upload-images allows Server Side Request Forgery.This issue affects Smart Auto Upload Images: from n/a through <= 1.2.2.
- Product
- Smart Auto Upload Images
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Smart Auto Upload Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Smartsupp – live chat, AI shopping assistant and chatbots: Stored Cross-Site ScriptingCVE-2025-12448 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smartsupp – live chat, AI shopping assistant and chatbots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'code' parameter in all versions up to, and including, 3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Smartsupp – live chat, AI shopping assistant and chatbots
- Affected
- up to 3.9.1
- What to do
- Affects up to 3.9.1. Update Smartsupp – live chat, AI shopping assistant and chatbots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 2026iSmartViewPro 1.3.34 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the camera ID input field.CVE-2019-25354 · Other software · Shenzhen Smarteye Digital Electronics Co., Ltd. · reported by VulnCheckMedium 4.6
iSmartViewPro 1.3.34 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the camera ID input field. Attackers can paste a 257-character buffer into the camera DID and password fields to trigger an application crash on iOS devices.
- Product
- iSmartViewPro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsmarteyegroup.comapps.apple.com
Feb 17, 2026Dell SmartFabric OS10 Software, versions prior to 10.5.6.12, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulCVE-2026-22284 · Other software · Dell · reported by security_alert@emc.comMedium 6.6
Dell SmartFabric OS10 Software, versions prior to 10.5.6.12, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
- Product
- SmartFabric OS10 Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026SmarterTools SmarterMail before 9526 allows XSS via MAPI requests.CVE-2026-26930 · Other software · SmarterTools · reported by MITREHigh 7.2
SmarterTools SmarterMail before 9526 allows XSS via MAPI requests.
- Product
- SmarterMail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsmartertools.comsmartertools.com
Feb 16, 2026A vulnerability was detected in LigeroSmart up to 6.1.26.CVE-2026-2547 · Other software · Ligerosmart · reported by VulDBLow 2
A vulnerability was detected in LigeroSmart up to 6.1.26. The impacted element is the function AgentDashboard of the file /otrs/index.pl. Performing a manipulation of the argument Subaction results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Ligerosmart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026A security vulnerability has been detected in LigeroSmart up to 6.1.26.CVE-2026-2546 · Other software · Ligerosmart · reported by VulDBLow 2
A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulation of the argument SortBy leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Ligerosmart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026A weakness has been identified in LigeroSmart up to 6.1.26.CVE-2026-2545 · Other software · Ligerosmart · reported by VulDBLow 2
A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketSearch. This manipulation of the argument Profile causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Ligerosmart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2026eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC methoCVE-2026-26369 · Other software · JUNG · reported by VulnCheckHigh 8.7
eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their account to the UG_ADMIN group, bypassing intended access controls and gaining administrative capabilities such as modifying device configurations, network settings, and other smart home system functions.
- Product
- eNet SMART HOME server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncheck.comzeroscience.mk
Feb 15, 2026eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated lowCVE-2026-26368 · Other software · JUNG · reported by VulnCheckHigh 8.7
eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated low-privileged user (UG_USER) to reset the password of arbitrary accounts, including those in the UG_ADMIN and UG_SUPER_ADMIN groups, without supplying the current password or having sufficient privileges. By sending a crafted JSON-RPC request to /jsonrpc/management, an attacker can overwrite existing credentials, resulting in direct account takeover with full administrative access and persistent privilege escalation.
- Product
- eNet SMART HOME server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncheck.comzeroscience.mk
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.