Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,608 results · page 77 of 353
Aug 11, 2026Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.CVE-2026-54984 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature lCVE-2026-54981 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.
- Product
- Python extension for Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.CVE-2026-54123 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.
- Product
- Microsoft Defender for Endpoint for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network.CVE-2026-54113 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code CVE-2026-49179 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose informatioCVE-2026-47285 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Exposure of sensitive information to an unauthorized actor for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow aCVE-2026-20737 · Other software · Intel · reported by secure@intel.comMedium 6.3
Exposure of sensitive information to an unauthorized actor for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (low) and availability (low) impacts.
- Product
- Proset/wireless Wifi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorizeCVE-2026-9214 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Medium 4.3
Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.
- Product
- R7000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comnetgear.com
Aug 11, 2026Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorizedCVE-2026-11738 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Medium 4.3
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.
- Product
- R7000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comnetgear.com
Aug 11, 2026Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorizCVE-2026-11737 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Medium 4.3
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality.
- Product
- RAX20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comnetgear.com
Aug 11, 2026A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router softCVE-2026-11736 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Low 1.9
A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality.
- Product
- RAX20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comnetgear.com
Aug 11, 2026A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the routCVE-2026-11735 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Low 1.9
A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality.
- Product
- R7000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comnetgear.com
Aug 11, 2026A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable.CVE-2026-11734 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Low 1.1
A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable.
- Product
- MR70
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comnetgear.com
Aug 11, 2026Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITCVE-2026-18129 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 8.1
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.
- Product
- Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.CVE-2026-18125 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.5
An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.
- Product
- Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remCVE-2026-17061 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comCritical 10
A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution.
- Product
- SIMULIA Execution Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 CVE-2026-72748 · Other software · WWBN · reported by VulnCheckMedium 6.9
AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline, or chain this with local file inclusion to achieve remote code execution.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the databaCVE-2026-72747 · Other software · WWBN · reported by VulnCheckMedium 5.1
AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary CVE-2026-72606 · Other software · Pinry · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get() without host or IP validation, and ALLOW_NEW_REGISTRATIONS defaults to true enabling anonymous triggering. An attacker can reach internal services or cloud metadata endpoints from the server.
- Product
- Pinry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profileCVE-2026-72605 · Other software · Swing Music · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can register an account and use it to access protected functionality on the server.
- Product
- Swing Music
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbiCVE-2026-72602 · Other software · AsyncFuncAI · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and returns a directory listing without authentication, as WIKI_AUTH_MODE defaults to false. An attacker can enumerate sensitive directory contents on the host system.
- Product
- deepwiki-open
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable inCVE-2026-72601 · Other software · CSZ CMS · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper fails open. An unauthenticated attacker can access all contact form submissions without credentials.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PCVE-2026-72600 · Other software · Idurar · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can enumerate MongoDB ObjectIds to download any invoice in the system without credentials.
- Product
- IDURAR ERP CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter.CVE-2026-72599 · Other software · e107 · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.8
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents including administrator credentials.
- Product
- e107
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary CVE-2026-72552 · Other software · Dub · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller-supplied URL without applying a denylist or requiring authentication. An attacker can use this to scan internal services or exfiltrate data from cloud metadata endpoints.
- Product
- Dub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the pCVE-2026-72550 · Other software · Friendica · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.8
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query() call, enabling stacked statement injection. An unauthenticated attacker can read, modify, or delete the entire database.
- Product
- Friendica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to CVE-2026-72549 · Other software · OpenSignLabs · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 5.3
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning the internal identifier. An attacker can use this to enumerate user accounts and target subsequent attacks.
- Product
- OpenSign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant recoCVE-2026-72548 · Other software · OpenSignLabs · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication or authorization checks. An attacker can enumerate and disclose tenant configuration data for any organisation in the system.
- Product
- OpenSign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact recordCVE-2026-72545 · Other software · OpenSignLabs · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target contact record. An attacker can corrupt or overwrite contact data for any user in the system without credentials.
- Product
- OpenSign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries viCVE-2026-72544 · Other software · OpenSignLabs · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP address as caller-supplied parameters without authentication, allowing fabrication of arbitrary audit log entries. An attacker can tamper with the legal audit trail of any signed document, undermining non-repudiation.
- Product
- OpenSign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact recordCVE-2026-72543 · Other software · OpenSignLabs · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or authorization checks before returning the requested contact object. An attacker can enumerate and read all contact records including personally identifiable information without credentials.
- Product
- OpenSign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription viCVE-2026-72536 · Other software · Chaskiq · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.6
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials.
- Product
- Chaskiq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any CVE-2026-72535 · Other software · Chaskiq · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.6
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. An attacker can access and manage subscription data for any tenant without credentials.
- Product
- Chaskiq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URCVE-2026-13739 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333High 8.8
A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.
- Product
- Commvault Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.com
Aug 11, 2026SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sCVE-2026-58231 · Websites & servers · SAP_SE · reported by cna@sap.comCritical 10
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.
- Product
- SAP Commerce Cloud (Data Hub Adapter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthentiCVE-2026-15560 · Other software · Red Hat · reported by Red HatHigh 8.1
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
- Product
- Red Hat JBoss Enterprise Application Platform 7.4.25
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 10, 2026SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component.CVE-2026-58247 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data from previously used memory, leading to a low on confidentiality, with no impact on integrity and availability of the application.
- Product
- SAP ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthCVE-2026-58243 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.8
SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.
- Product
- SAP ABAP Developer Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access schedulingCVE-2026-44765 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.3
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve, create, modify, or delete application-managed scheduling data, causing a low impact on confidentiality, integrity, and availability.
- Product
- SAP Manufacturing Integration and Intelligence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests toCVE-2026-44764 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.3
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations. Successful exploitation could allow the attacker to read, create, modify, or delete application-managed business data, resulting in a limited impact on the confidentiality, integrity, and availability of the affected system.
- Product
- SAP Manufacturing Integration and Intelligence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption.CVE-2026-34265 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.8
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.
- Product
- SAP NetWeaver and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actionCVE-2025-32736 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comMedium 4.9
Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.
- Product
- PingFederate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Aug 10, 2026TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server.CVE-2025-15683 · Other software · TBEA · reported by office@cyberdanube.comHigh 8.8
TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm, and UpdatePortConfig.
- Product
- TBEA TLogger (TBEA Communication Box 3rd Generation)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server.CVE-2025-15682 · Other software · TBEA · reported by office@cyberdanube.comHigh 8.7
TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT requests to the /tmp/ endpoint, causing the web server to create persistent files containing attacker-controlled data under /opt/myapp/webserver/. The generated files are not removed because the web server attempts to move them into a non-existent directory. Repeated requests can therefore exhaust available storage and cause a denial-of-service condition.
- Product
- TBEA TLogger (TBEA Communication Box 3rd Generation)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0.CVE-2025-13294 · Other software · TBEA · reported by office@cyberdanube.comCritical 9.3
An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploit these endpoints to read, modify, or delete data stored in the device's CCU.db database.
- Product
- TBEA TLogger (TBEA Communication Box 3rd Generation)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the deCVE-2025-13293 · Other software · TBEA · reported by office@cyberdanube.comCritical 9.3
A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticate to the SSH service. Successful exploitation provides full administrative control of the affected device.
- Product
- TBEA TLogger (TBEA Communication Box 3rd Generation)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauCVE-2026-71962 · Other software · FlowiseAI · reported by VulnCheckHigh 8.7
Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypasses all session and API key verification. Attackers can supply valid chatflowId, chatId, and fileName identifiers to retrieve files from any chatflow on the instance, including private chatflows belonging to other workspaces or organizations.
- Product
- Flowise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordflowiseai.comgist.github.com
Aug 10, 2026Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.CVE-2026-72899 · Other software · Metabase · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 10
Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.
- Product
- Metabase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Aug 10, 2026Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server.CVE-2026-16626 · Other software · Jaspersoft · reported by db6d2600-d19b-4111-a010-f3c4ed70cd50Critical 9.3
Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server. This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.
- Product
- JasperReports Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.jaspersoft.com
Aug 10, 2026ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpCVE-2026-63106 · Websites & servers · Razinsoft · reported by VulnCheckCritical 9.3
ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform time-based blind SQL injection through the unsanitized rating parameter to extract the full database contents, including user credentials and administrator password hashes, with potential additional file system access due to the database connection running as root.
- Product
- Ready eCommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netvulncheck.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.