Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,823 results · page 8 of 137
Aug 27, 2026Trilium is an open-source hierarchical note-taking application.CVE-2026-47727 · Other software · TriliumNext · reported by GitHubHigh 8.6
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side template that leads to remote code execution. The relation is omitted from the built-in list of dangerous attributes, so unlike other code-loading relations it is not disabled on import, and when the victim later publishes the imported note the public share renderer feeds the linked EJS code note's raw bytes into ejs.render, which compiles them in the server's Node process. An unauthenticated request to the shared note then executes the attacker's JavaScript with full access to require, process, the filesystem, and the network. This issue is fixed in version 0.104.0.
- Product
- Trilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys acroCVE-2026-81689 · Other software · jahlives · reported by VulnCheckHigh 8.7
openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.
- Product
- openssl_encrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 27, 2026If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole autCVE-2026-81576 · Other software · wibu-systems-ag · reported by 2fc02b1f-71e7-4514-a878-169626f68903High 7.7
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.
- Product
- codemeter-runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded nCVE-2026-47881 · Other software · Spring · reported by security@vmware.comMedium 5.9
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13
- Product
- Spring Batch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to cause a stack-based buffCVE-2026-21807 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.9
HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to cause a stack-based buffer overflow.
- Product
- BigFix Quantum Risk Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 26, 2026An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofedCVE-2025-61480 · Other software · reported by MITREHigh 7.5
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the sequence or acknowledgment numbers.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via the SPCCVE-2025-61479 · Other software · reported by MITREHigh 7.5
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via the SPC Connect Pro software accepts replayed application-layer payloads injected into an active TCP session.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via SpoofedCVE-2025-61478 · Other software · reported by MITREHigh 7.5
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via Spoofed SYN packets.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoiCVE-2026-47837 · Other software · Spring · reported by security@vmware.comMedium 6.8
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.
- Product
- Spring Cloud Config
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: k3: set hdma clock as critical HDMA clock is responsible for the internal TCVE-2026-80523 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: k3: set hdma clock as critical HDMA clock is responsible for the internal TCM access path of X100 RISC-V core, so set the clock flag as critical to prevent it from being shut off, otherwise the Linux system will hang, for example in the case of a vector instruction access generates a page fault.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 26, 2026Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior CVE-2026-75062 · Computers, phones & browsers · Google · reported by cve-coordination@google.comCritical 9.2
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt inputs that cause the model to generate executable Python expressions evaluated without a sandbox.
- Product
- langfun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application.CVE-2026-12587 · Other software · Resamania · reported by cve-coordination@incibe.esHigh 8.6
The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badge_number' parameter as the HMAC private key, the value of which remains static and is accessible via the API using the endpoint '/club/_id_club_/member/_id_member_/resamania_qr_info'. An attacker with access to this value and to the application’s cryptographic logic, which can be extracted by reverse engineering the APK as there is no code obfuscation, could generate valid QR codes indefinitely, even after the user has changed their password or logged out.
- Product
- Virtuagym
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python.CVE-2026-55099 · Other software · collective · reported by GitHubHigh 7.5
icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child components, causing O(2^n) work relative to nesting depth. Component.from_ical accepts arbitrarily nested BEGIN:VEVENT blocks without a depth limit, so an attacker can submit a sub-kilobyte .ics file containing equal nested subtrees and trigger the cost when an application performs equality, inequality, membership, deduplication, test-assertion, round-trip, or normalization comparisons. Parsing alone does not trigger the issue, and comparisons that differ early short-circuit, but a few hundred bytes can pin a CPU core for minutes or indefinitely, causing denial of service in calendar sync or import endpoints, invite processing, and other comparison paths. This issue is fixed in version 7.1.3.
- Product
- icalendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to rCVE-2026-79786 · Other software · coroot · reported by VulnCheckHigh 7
Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.
- Product
- coroot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of rCVE-2026-79772 · Other software · sparklemotion · reported by VulnCheckMedium 6.9
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.
- Product
- nokogiri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 25, 2026Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company SoftCVE-2026-16286 · Other software · TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company · reported by iletisim@usom.gov.trCritical 9.8
Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This issue affects Software Repository Management: before 2fb4acee.
- Product
- Software Repository Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2026Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability.CVE-2026-78685 · Other software · Le-yan · reported by twcert@cert.org.twHigh 8.6
Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page.
- Product
- Medical Practice Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 24, 2026An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers with UART access to CVE-2026-75371 · Other software · reported by MITREHigh 7.5
An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers with UART access to cause a Denial of Service (DoS) via a crafted input.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2026A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, CVE-2026-66897 · Other software · Canonical · reported by security@ubuntu.comCritical 9.9
A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Missing authentication for critical function vulnerability in IKAS Technology Inc.CVE-2026-19441 · Other software · IKAS Technology Inc. · reported by iletisim@usom.gov.trMedium 5.3
Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data. This issue affects Rush: through 21082026. NOTE: The vendor was contacted and it was learned that the product is not supported.
- Product
- Rush
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating physical pages leading CVE-2026-45201 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceHigh 7.8
Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating physical pages leading to OOB read and/or write due to improper validation of the said value. Such crafted log2 page size could lead to 4K pages being treated as higher order pages and allowing read and/or write access to the memory beyond 4K threshold.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Missing authentication for critical function vulnerability exists in VOCALOID6.CVE-2026-76137 · Other software · Yamaha Corporation · reported by vultures@jpcert.or.jpMedium 4.8
Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe.
- Product
- VOCALOID6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticatedCVE-2026-76157 · Other software · Datiphy Inc. · reported by ART@zuso.aiHigh 8.8
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory.
- Product
- Data Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with thCVE-2026-77113 · Other software · Canonical · reported by security@ubuntu.comMedium 6.7
Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files.
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlaunchpad.net
Aug 20, 2026A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM.CVE-2026-77645 · Other software · PTC · reported by 0b655efc-079c-4cb9-9e8d-164871239f4eCritical 9.2
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
- Product
- Windchill PDMLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition.CVE-2026-77644 · Other software · PTC · reported by 0b655efc-079c-4cb9-9e8d-164871239f4eCritical 9.3
A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition.
- Product
- Windchill Risk and Reliability Enterprise Edition (Formerly Relex)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LACVE-2026-61898 · Other software · Canonical · reported by security@ubuntu.comHigh 7.8
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.
- Product
- accountsservice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netubuntu.com
Aug 20, 2026An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts.CVE-2026-61897 · Other software · Canonical · reported by security@ubuntu.comHigh 7.8
An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.
- Product
- accountsservice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netubuntu.com
Aug 20, 2026Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc.CVE-2026-15706 · Other software · Baylan Measuring Instruments Industry and Trade Inc. · reported by iletisim@usom.gov.trCritical 9.8
Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.
- Product
- Baylan Smart Meter Management Application (BMS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check tCVE-2026-16838 · Other software · IBM · reported by psirt@us.ibm.comHigh 7
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use (TOCTOU) race condition.
- Product
- AIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026TrueConf Server Missing Authentication for Critical Function VulnerabilityCVE-2026-72529 · Other software · TrueConf · reported by vulnerability@kaspersky.comExploitedCritical 9.3
TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.
- Product
- Server
- On CISA’s list since
- Aug 20, 2026 (federal fix deadline Aug 23, 2026)
- What to do
- Attackers are using this now. Install TrueConf’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogics-cert.kaspersky.comsecurelist.com
Aug 19, 2026A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to eCVE-2026-20302 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root privileges. This vulnerability is due to insufficient boundary checks for specific data that is provided through the USB driver. An attacker could exploit this vulnerability by connecting a malicious USB device to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system and execute arbitrary code with root privileges.
- Product
- Cisco RoomOS Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 19, 2026Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user CVE-2026-76203 · Other software · maalfer · reported by 4daa8cea-433a-44bd-9456-53b127fc289aMedium 5.1
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist
- Product
- Pentestify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pagCVE-2026-49418 · Other software · FreeBSD · reported by secteam@freebsd.orgHigh 8.8
When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This corrupts the list, and on object destruction the page is freed twice. An unprivileged local user with access to a device that provides memory-mapped I/O can trigger a use-after-free in the kernel, though this is limited to a pool of objects ("fictitious pages") that are never recycled for a different purpose. It may be possible to exploit this to escalate privileges.
- Product
- FreeBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, CVE-2026-21580 · Websites & servers · Atlassian · reported by security@atlassian.comCritical 9.3
This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and Server. This Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability, with a CVSS Score of 8.6, allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser, perform actions as a higher-privileged user, and to get into the system utilizing loopholes exposed from security best-practices being overlooked. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.21 Confluence Data Center and Server 10.2: Upgrade to a release greater than or equal to 10.2.13 See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest vers
- Product
- Confluence Data Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconfluence.atlassian.comjira.atlassian.com
Aug 18, 2026ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record.CVE-2026-52723 · Other software · fbeta-GmbH · reported by GitHubCritical 9.1
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signed_vau_server_pub_keys and AUT_VAU_CertData certificate path to independent trusted material. A network-positioned attacker between the DiGA backend and the ePA system can intercept the VAU handshake, supply attacker-controlled certificate and key material, and satisfy the circular trust relationship. Because TLS certificate verification is also disabled in affected versions, no independent server-authentication layer prevents the attack. The attacker can impersonate the VAU server, control the negotiated session keys, and read or modify all encrypted VAU traffic. This issue is fixed in version 1.3.0.
- Product
- ePA3-Service-OpenSource
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record.CVE-2026-50578 · Other software · fbeta-GmbH · reported by GitHubHigh 7.5
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in app/konnektor/Konnektor.py. A network-positioned attacker can present an arbitrary certificate, terminate the TLS connection, and intercept ePA traffic. The VAU protocol does not provide an effective fallback because its application-layer certificate validation is also broken in affected versions. The Konnektor session uses self.session.verify set to False while the client authenticates with self.session.cert, so an attacker impersonating the Konnektor can receive the client's mutual TLS certificate exchange and observe smartcard operations. This issue is fixed in version 1.3.0.
- Product
- ePA3-Service-OpenSource
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record.CVE-2026-50577 · Other software · fbeta-GmbH · reported by GitHubHigh 7.4
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves request_counter unchanged in app/vau/VAUProtokoll.py while constructing VAU messages. The frozen client request counter causes the server side to reuse AES-GCM nonce and key combinations across responses. A network attacker who collects repeated ciphertexts can recover the XOR of plaintexts and use predictable inner HTTP headers and JSON fields to recover sensitive data, including patient health records. Repeated nonces can also enable recovery of the GHASH authentication key through the Joux forbidden attack, allowing forged AES-GCM messages and injection of malicious responses. The response-counter check also fails to maintain last_response_counter, weakening replay and ordering validation. This issue is fixed in version 1.3.0.
- Product
- ePA3-Service-OpenSource
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record.CVE-2026-50576 · Other software · fbeta-GmbH · reported by GitHubMedium 6.8
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The build_inner_header function interpolates the uri, host, accept_type, content_type, content_length, USER_AGENT, and insurant_id values into request lines and headers, including x-useragent and x-insurantid. An authenticated attacker who controls a value can inject additional headers into the inner request. Depending on ePA server handling, an injected x-insurantid header can expose another patient's records, and injected Authorization headers can bypass the intended authentication or authorization context. Session-derived USER_AGENT input can also poison requests across the session. This issue is fixed in version 1.3.0.
- Product
- ePA3-Service-OpenSource
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote senCVE-2026-50126 · Other software · KNMI · reported by GitHubMedium 4
Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry contains a malformed coordinate. The coordinate parser in `adagucserverEC/CConvertGeoJSON.cpp` indexes `pt.u.array.values[0]` and `pt.u.array.values[1]` and uses `polygon.u.array.length` as a loop bound without first validating the JSON node type or the coordinate length. A coordinate that is an empty array, a one-element array, a scalar, or `null` leads to an out-of-bounds heap read or a NULL pointer dereference. The same unchecked pattern is present in four geometry branches: `Polygon`, `LineString`, `MultiLineString` and `MultiPolygon`. The vulnerable parser runs whenever the server processes a local GeoJSON file, either a configured GeoJSON dataset or a GeoJSON file exposed through the `AutoResource` feature and requested by an unauthenticated WMS request. A crafted GeoJSON file reliably crashes the backend process that handles that request. Version 7.2.2 patches the vulnerability.
- Product
- adaguc-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files.CVE-2026-75914 · Other software · Hmbown · reported by VulnCheckHigh 8.7
CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases.CVE-2026-45733 · Other software · TriliumNext · reported by GitHubHigh 8.3
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0.
- Product
- Trilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading toCVE-2026-23938 · Other software · Zabbix · reported by security@zabbix.comLow 2.1
An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.apiCVE-2026-23934 · Other software · Zabbix · reported by security@zabbix.comMedium 5.1
An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testCVE-2026-23930 · Other software · Zabbix · reported by security@zabbix.comMedium 5.3
An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata.CVE-2026-75626 · Other software · smicallef · reported by VulnCheckCritical 9.3
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.
- Product
- spiderfoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA privatCVE-2026-51977 · Other software · reported by MITRECritical 9.1
An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbtirary code via a crafted .dll file.CVE-2026-50773 · Other software · reported by MITREHigh 7.8
An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbtirary code via a crafted .dll file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generatCVE-2026-74900 · Other software · jahlives · reported by VulnCheckCritical 9.3
openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain 16 bytes of the private key can compute the shared secret and decrypt all ciphertext, as the fallback triggers on any KEM failure without raising an error.
- Product
- openssl_encrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 15, 2026In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: hold conn reference in abort_conn_sync() There is theoretical UAF if CVE-2026-74531 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.8
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: hold conn reference in abort_conn_sync() There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.