Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,608 results · page 78 of 353
Aug 10, 2026A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-fliCVE-2026-72692 · Other software · OpenSignLabs · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification against any accessible document.
- Product
- opensignserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file acCVE-2026-72691 · Other software · OpenSignLabs · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication gate to be bypassed by supplying an arbitrary string as docId.
- Product
- opensignserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contrCVE-2026-72689 · Other software · OpenSignLabs · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and returns full records including sender and signer PII and a pre-signed document download URL whenever the document's IsEnableOTP flag is unset, which is the default configuration.
- Product
- opensignserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documentCVE-2026-72688 · Other software · OpenSignLabs · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTER_KEY-signed file access tokens for any caller-supplied URL without performing any session check, defeating the only access control protecting stored contract files.
- Product
- opensignserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting.CVE-2026-6373 · Network & remote access · Zyxel Networks · reported by iletisim@usom.gov.trMedium 6.5
Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026.
- Product
- WAH7601
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026In the Linux kernel, the following vulnerability has been resolved: arm64: make huge_ptep_get handled unaligned addresses huge_ptep_get() can be handed a virtCVE-2026-68172 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: arm64: make huge_ptep_get handled unaligned addresses huge_ptep_get() can be handed a virtual address pointing to the middle of a contpmd/contpte mapped hugetlb folio (examples of callers are pagemap_hugetlb_range, page_mapped_in_vma). The arm64 helper rewalks the pgtables in find_num_contig to answer whether the huge pte we have maps a contpmd or a contpte hugetlb folio, and returns CONT_PMDS or CONT_PTES, so that it can collect a/d bits over the contiguous ptes. We can falsely return CONT_PTES instead of CONT_PMDS if the addr is not aligned. On systems where CONT_PTES != CONT_PMDS (meaning page size is 16K), we could collect excess A/D bit state, meaning extra work for the kernel. Even worse, we may iterate beyond the PTE table and dereference a garbage ptep pointer to access physical memory we don't own. Since the ptep pointer is a linear map address, we may run off the end of the linear map or into a hole, dereference a VA not mapped into the kernel pgtables and cause kernel panic. Fix this by aligning the pmdp pointer down to a contpmd base before checking equality with the passed huge pte pointer, to corr
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 10, 2026A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality iCVE-2026-72593 · Other software · dulldusk · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.8
A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem.
- Product
- phpfm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server.CVE-2026-72592 · Other software · dulldusk · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.8
An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter ( = array) and no authentication enabled by default (auth_pass is empty string), allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path.
- Product
- phpfm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries byCVE-2026-72590 · Other software · alseambusher · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.8
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.
- Product
- crontab-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands byCVE-2026-72589 · Other software · alseambusher · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.8
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validation.
- Product
- crontab-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address iCVE-2026-72588 · Other software · bluewave-labs · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 5.3
A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts.
- Product
- Checkmate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache byCVE-2026-72587 · Other software · CoreBunch · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 6.1
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server island endpoint.
- Product
- Instatic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DACVE-2026-72586 · Other software · frangoteam · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on tCVE-2026-72584 · Other software · fastschema · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.4
A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes.
- Product
- fastschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP CVE-2026-72582 · Other software · fastschema · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating it is non-nil, causing a fatal panic that terminates the entire server when a recovery request is sent to the /api/auth/local/recover endpoint.
- Product
- fastschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalCVE-2026-72578 · Other software · FreePBX · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.8
A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator.
- Product
- FreePBX Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station hosCVE-2026-72577 · Other software · NASA · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.8
Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint.
- Product
- fprime-gds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup recordsCVE-2026-72575 · Other software · daptin · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.1
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it.
- Product
- daptin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assetsCVE-2026-72574 · Other software · picocms · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 6.1
A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.
- Product
- Pico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and download arbitrary files from the server.CVE-2026-72572 · Other software · o1lab · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.join(cwd, name) without sanitization before passing it to res.download, enabling directory traversal via ../ sequences to access sensitive system files.
- Product
- xmysql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server.CVE-2026-72571 · Other software · mustafaakin · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile() without sanitization, enabling directory traversal via absolute paths or ../ sequences to read sensitive system files.
- Product
- cast-localvideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intendCVE-2026-72569 · Other software · cube-root · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.1
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option.
- Product
- directory-serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbiCVE-2026-72567 · Other software · AsyncFuncAI · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.8
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repo_type fields without sanitization, enabling path traversal.
- Product
- deepwiki-open
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary datCVE-2026-72565 · Other software · Tencent · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.8
A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator.
- Product
- APIJSON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc featCVE-2026-66915 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc plugin.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfabrikar.commysites.guru
Aug 10, 2026Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service.CVE-2026-44630 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. This issue affects Apache IoTDB: before 1.3.8, from 2.0.0 before 2.0.9. Users are recommended to upgrade to version 2.0.10, which fixes the issue.
- Product
- Apache IoTDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 10, 2026All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`,CVE-2026-19075 · WordPress plugins & themes · reported by WPScanMedium 5
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester.
- What to do
- Update the plugin to the newest version.
Aug 10, 2026ProSolution WP Client: Does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitorsCVE-2026-19053 · WordPress plugins & themes · reported by WPScanCritical 9.1
The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.
- Product
- ProSolution WP Client
- Fixed in
- 2.0.6
- What to do
- Update ProSolution WP Client to 2.0.6 or newer.
Aug 9, 2026WP Data Access: Does not validate the column names it accepts on one of its unauthenticated AJAX actionsCVE-2026-18032 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected front-end form is bound to, including user password hashes where that table is the users table.
- Product
- WP Data Access
- Fixed in
- 5.5.79
- What to do
- Update WP Data Access to 5.5.79 or newer.
Aug 9, 2026LWS Optimize: Does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboardCVE-2026-16032 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.
- Product
- LWS Optimize
- Fixed in
- 4.1.2
- What to do
- Update LWS Optimize to 4.1.2 or newer.
Aug 7, 2026Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints.CVE-2026-19113 · Other software · HashiCorp · reported by security@hashicorp.comMedium 5.3
Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptanCVE-2026-15972 · Other software · HashiCorp · reported by security@hashicorp.comHigh 7.5
Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an unauthenticated remote attacker to abort the ErlaCVE-2026-67585 · Other software · DivvyPayHQ · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.7
Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an unauthenticated remote attacker to abort the Erlang VM via crafted _entities representation keys. Every key of every object in the representations argument of the federation-mandated _entities field is converted with String.to_atom/1 by convert_key/2 in lib/absinthe/federation/schema/entities_field.ex. representations is typed as the open-ended _Any scalar, so its keys bypass schema coercion and the attacker names them freely. Atoms are never garbage collected and the BEAM atom table is hard-capped (about 1,048,576 entries by default), so one request carrying tens of thousands of unique keys creates that many permanent atoms and a handful of such requests exhausts the table and aborts the node. The impact is confined to availability: no data is read or altered, and recovery requires restarting the application. This issue affects absinthe_federation: from 0.1.0 before 0.9.3.
- Product
- absinthe_federation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Aug 7, 2026A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impaCVE-2026-20348 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR files during scanning. An attacker could exploit this vulnerability by submitting a crafted file that contains XAR content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
- Product
- Cisco Secure Endpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 7, 2026A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded iCVE-2026-20347 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in Mach-O files during scanning, which may result in an out-of-bounds buffer read. An attacker could exploit this vulnerability by submitting a crafted Mach-O file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
- Product
- Cisco Secure Endpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 7, 2026A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impaCVE-2026-20346 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF files during scanning, which may result in an out-of-bounds buffer read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
- Product
- Cisco Secure Endpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 7, 2026A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impaCVE-2026-20345 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion operation, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted GPT file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
- Product
- Cisco Secure Endpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 7, 2026A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded iCVE-2026-20339 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an integer overflow. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
- Product
- Cisco Secure Endpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 7, 2026A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.CVE-2026-20338 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate as a result of a memory double-free, resulting in a DoS condition on the affected software.
- Product
- Cisco Secure Endpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 7, 2026A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.CVE-2026-20337 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
- Product
- Cisco Secure Endpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 7, 2026Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary fileCVE-2022-4995 · Other software · Weaver Network Co., Ltd. · reported by VulnCheckCritical 9.3
Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp with arbitrary secId and plandetailid field values. Successful exploitation results in remote code execution under the privileges of the application server process. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14 (UTC).
- Product
- E-cology 9.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordch0x01e.github.iocn-sec.com
Aug 7, 2026Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unauthenticated attacker could download files from bothCVE-2026-66914 · Websites & servers · reported by security@joomla.orgCritical 9.2
Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious CVE-2026-66494 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically..
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existiCVE-2026-54208 · Other software · Tobit Laboratories AG · reported by vulnerability@ncsc.chHigh 8.5
Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper validation or restriction on file types. As a result, an attacker can create files (e.g., .htm), containing malicious JavaScript code. When a user accesses a file created in this way, stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
- Product
- TeamDavid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchayns.netlabs.infoguard.ch
Aug 7, 2026Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information.CVE-2026-54203 · Other software · Tobit Laboratories AG · reported by vulnerability@ncsc.chCritical 9.2
Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds with memory. By repeatedly requesting this endpoint, an attacker can access sensitive information, including user passwords. Exploitation does not require authentication. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
- Product
- TeamDavid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchayns.netlabs.infoguard.ch
Aug 6, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform sCVE-2026-70332 · Email & office · Microsoft · reported by secure@microsoft.comCritical 9.6
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.CVE-2026-65667 · Email & office · Microsoft · reported by secure@microsoft.comCritical 10
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Teams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.CVE-2026-63508 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Planetary Computer Pro (GeoCatalog)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.CVE-2026-62918 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Teams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.CVE-2026-62873 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft 365 Admin Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.