Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23,145 results · page 7 of 463
Oct 25, 2026YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through CVE-2026-116202 · Other software · YesWiki · reported by VulnCheckMedium 5.1
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar ImageField class. Attackers can submit a malicious SVG via the image field of the entries API, which is served as image/svg+xml and executes script for users viewing the entry or file.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownTCVE-2026-116139 · Other software · WWBN · reported by VulnCheckMedium 5.1
WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML() preserves event-handler attributes in leading HTML blocks. Attackers can post a comment starting with an img tag carrying an onerror handler, which bypasses the inline sanitizer and executes in viewers' browsers under the application origin.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry CVE-2026-116137 · Other software · cthackers · reported by VulnCheckMedium 6.3
adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.
- Product
- adm-zip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorCVE-2026-116136 · Other software · projectsend · reported by VulnCheckMedium 6
ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing moveAssignmentsToRoot() to expose protected original files to unauthorized clients.
- Product
- ProjectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled accCVE-2026-116072 · Other software · Docile-Alligator · reported by VulnCheckMedium 5.3
Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the app's client ID with their own Reddit account, then deliver an infinity://localhost redirect containing their code and the constant state, causing the victim's posts, messages, and browsing to occur on the attacker's account.
- Product
- Infinity for Reddit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and ovCVE-2026-116070 · Other software · dqzboy · reported by VulnCheckMedium 6.9
Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.
- Product
- Docker-Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications bCVE-2026-116068 · Other software · Dokploy · reported by VulnCheckHigh 8.7
Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2026yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sendingCVE-2026-116016 · Other software · YunaiV · reported by VulnCheckHigh 7.1
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.
- Product
- yudao-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2026yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other CVE-2026-116015 · Other software · YunaiV · reported by VulnCheckMedium 5.3
yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.
- Product
- yudao-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2026DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign prCVE-2026-116008 · Other software · Bottelet · reported by VulnCheckMedium 5.3
DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message.CVE-2026-115863 · Other software · ConnMan · reported by MITREHigh 7.6
ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.
- Product
- ConnMan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 23, 2026Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a maliCVE-2026-57845 · Other software · huggingface · reported by VulnCheckHigh 8.7
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset("pandas", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges.
- Product
- datasets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5CVE-2026-102786 · Websites & servers · reported by security@joomla.orgHigh 8.6
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an aCVE-2026-114357 · Other software · DJI · reported by vulnerability@ncsc.chCritical 9.3
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).
- Product
- CrystalSky ZS600C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber-defence-campus.github.io
Oct 23, 2026Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local aCVE-2026-114356 · Other software · DJI · reported by vulnerability@ncsc.chHigh 7
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.
- Product
- CrystalSky ZS600C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber-defence-campus.github.io
Oct 23, 2026OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprCVE-2026-114355 · Other software · DJI · reported by vulnerability@ncsc.chHigh 8.6
OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.
- Product
- CrystalSky ZS600C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber-defence-campus.github.io
Oct 23, 2026Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on ACVE-2026-114354 · Other software · DJI · reported by vulnerability@ncsc.chHigh 8.6
Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.
- Product
- CrystalSky ZS600C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber-defence-campus.github.io
Oct 23, 2026Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android alCVE-2026-114353 · Other software · DJI · reported by vulnerability@ncsc.chHigh 7
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().
- Product
- CrystalSky ZS600C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber-defence-campus.github.io
Oct 23, 2026A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through theCVE-2026-10632 · Email & office · Zimbra · reported by cve@rapid7.comHigh 8.7
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can supply their own authentication token and document identifiers in a URL and execute JavaScript in another signed-in user's Zimbra browser session when that user opens the URL. This permits reading mailbox data and performing authenticated actions as the victim. The issue affects ZCS 10.1.16 and was remediated in 10.1.17.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comrapid7.com
Oct 23, 2026Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auCVE-2026-115726 · Other software · Aider-AI · reported by VulnCheckHigh 8.5
Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges.
- Product
- aider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers CVE-2026-115723 · Other software · davenardella · reported by VulnCheckHigh 8.3
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.
- Product
- snap7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or valuCVE-2026-115722 · Other software · diegonehab · reported by VulnCheckMedium 6.9
RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing.
- Product
- rply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Otter Blocks: Does not correctly determine whether a post is publicly readable before returning its data through a REST API endpointCVE-2026-109934 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
- Product
- Otter Blocks
- Fixed in
- 3.2.8
- What to do
- Update Otter Blocks to 3.2.8 or newer.
Oct 23, 2026OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.CVE-2026-115638 · Other software · OpenStack · reported by MITREMedium 4.3
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
- Product
- Ironic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netopenwall.com
Oct 22, 2026libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amCVE-2026-115506 · Other software · libexpat · reported by VulnCheckHigh 8.7
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.
- Product
- libexpat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variabCVE-2026-115504 · Other software · HEASARC · reported by VulnCheckHigh 8.5
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.
- Product
- cfitsio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 22, 2026Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an uncheckedCVE-2026-115394 · Other software · NationalSecurityAgency · reported by VulnCheckMedium 6.8
Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF packed database file, triggering an OutOfMemoryError in PackedDatabase.open() that aborts the import and denies service.
- Product
- ghidra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dCVE-2026-115389 · Other software · bytecodealliance · reported by VulnCheckLow 1
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 22, 2026Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copyCVE-2026-115372 · Other software · lxc · reported by VulnCheckCritical 9
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root.
- Product
- incus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 22, 2026OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/cCVE-2026-115363 · Other software · openbao · reported by VulnCheckLow 2.1
OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.
- Product
- openbao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 22, 2026A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textCVE-2026-114654 · Other software · MongoDB · reported by cna@mongodb.comMedium 6.9
A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire representation, producing binary elements that misdeclare their type or length. An unauthenticated party able to supply text parsed by an affected application can cause it to emit and persist malformed binary data, which subsequent readers either reject with an error or silently interpret as shorter than the data that was validated.
- Product
- C# Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a CVE-2026-93336 · Other software · Canonical · reported by security@ubuntu.comHigh 7.1
Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model, including container-registry credentials, via a crafted request naming an arbitrary unit.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated uCVE-2026-115453 · Websites & servers · MarcosCamara01 · reported by 4daa8cea-433a-44bd-9456-53b127fc289aHigh 7.1
Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete(), cartRepository.updateQuantityInternal() and wishlistRepository.delete() in src/lib/db/drizzle/repositories/ match rows by primary key alone, with no predicate on the owning user, and the per user authorization for those three operations rests on PostgreSQL row level security. The migrations run ALTER TABLE ... ENABLE ROW LEVEL SECURITY and create policies comparing app.current_user_id() with user_id, but never ALTER TABLE ... FORCE ROW LEVEL SECURITY, and PostgreSQL does not apply policies to the role that owns a table. The template uses one DATABASE_URL both to run the migrations, which create the tables, and for the application at runtime, so the application connects as the owner of the tables and the policies do not apply to it. cart_items.id and wishlist.id are sequential bigserial values, so the identifiers of rows belonging to other users can be enumerated, and the update path returns the modified row, which carries
- Product
- Ecommerce Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authentiCVE-2026-114487 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization CVE-2026-115334 · Other software · uselotus · reported by VulnCheckHigh 7.6
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.
- Product
- lotus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checCVE-2026-115333 · Other software · uselotus · reported by VulnCheckHigh 8.2
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.
- Product
- lotus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filtCVE-2026-115332 · Other software · uselotus · reported by VulnCheckHigh 8.7
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.
- Product
- lotus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric proCVE-2026-115331 · Other software · uselotus · reported by VulnCheckHigh 8.7
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.
- Product
- lotus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statemenCVE-2026-115330 · Other software · uselotus · reported by VulnCheckHigh 8.7
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.
- Product
- lotus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organCVE-2026-115329 · Other software · uselotus · reported by VulnCheckMedium 6
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.
- Product
- lotus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action enveCVE-2026-115327 · Other software · CESNET · reported by VulnCheckMedium 6
libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.
- Product
- libyang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authentiCVE-2026-115326 · Other software · Webkul · reported by VulnCheckMedium 5.3
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.
- Product
- QloApps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clientsCVE-2026-115325 · Other software · gravitl · reported by VulnCheckHigh 8.7
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.
- Product
- netmaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listenCVE-2026-115319 · Other software · junegunn · reported by VulnCheckLow 2
fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.
- Product
- fzf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that alloCVE-2022-51022 · Other software · liukuo362573 · reported by VulnCheckHigh 8.8
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
- Product
- YiShaAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and inclCVE-2021-48016 · Other software · DedeCMS · reported by VulnCheckCritical 9.3
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
- Product
- DedeCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weCVE-2021-48013 · Other software · Weaver Network Co., Ltd. · reported by VulnCheckHigh 8.7
Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal sequences in fpath to retrieve sensitive files such as WEB-INF/web.xml from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
- Product
- E-cology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern CVE-2020-37284 · Other software · midgetspy · reported by VulnCheckMedium 5.1
Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming handler returns unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
- Product
- Sickbeard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 22, 2026WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter CVE-2019-25779 · Other software · WooThemes · reported by VulnCheckHigh 8.7
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- Diarise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comgithub.com
Oct 22, 2026SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through CVE-2019-25778 · Other software · SeaCMS · reported by VulnCheckHigh 8.8
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
- Product
- SeaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.