Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,161 results · page 8 of 304
Oct 12, 2026IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.CVE-2026-92876 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
- Product
- Maximo Application Suite - IoT Component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Convex is an open-source reactive database for application developers.CVE-2026-97691 · Other software · get-convex · reported by GitHubMedium 4.3
Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled-2026-08-10-c0cb7ae, a malicious user can, in rare cases, perform unauthorized reading of deployment information from a Convex deployment. The maintainer has intentionally withheld the affected component and technical mechanism to protect self-hosted deployments that have not been updated, and no evidence of exploitation is known. Convex cloud deployments were patched automatically. This issue is fixed in the self-hosted image published on August 10, 2026 and local binary precompiled-2026-08-10-c0cb7ae.
- Product
- convex-backend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop CVE-2026-75881 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs.
- Product
- Maximo Application Suite - IoT Component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026OWASP Coraza WAF is a golang modsecurity compatible web application firewall library.CVE-2026-41508 · Other software · corazawaf · reported by GitHubMedium 5.8
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_STRICT_ERROR. A remote attacker can submit a truncated multipart body that produces io.ErrUnexpectedEOF, causing parsing to stop without raising the strict-error signal used by the recommended defensive rule. Rules 200002 and 200003 do not fire, allowing multipart parser-disagreement payloads to reach a backend that interprets the truncated body differently. This issue is fixed in version 3.8.0.
- Product
- coraza
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026OWASP Coraza WAF is a golang modsecurity compatible web application firewall library.CVE-2026-41504 · Other software · corazawaf · reported by GitHubMedium 5.8
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When SecAuditLogFormat Native is enabled, injected line breaks can create forged lines inside a transaction record. An attacker who controls request or response body, header, error-message, or matched-rule data can inject carriage returns and line feeds that appear as forged audit lines within a transaction record. The forged content can mislead operators and line-oriented SIEM processing, although the unpredictable transaction boundary prevents straightforward impersonation of a separate complete session. This issue is fixed in version 3.8.0.
- Product
- coraza
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container CVE-2026-18537 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.7
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.
- Product
- Maximo Application Suite - Location Service for Esri Component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container CVE-2026-18533 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image configuration in a Kubernetes operator template.
- Product
- Maximo Application Suite - Location Service for Esri Component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-cCVE-2026-18529 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.7
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.
- Product
- Maximo Application Suite - Location Service for Esri Component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulneCVE-2026-18517 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.7
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.
- Product
- Maximo Application Suite - Location Service for Esri Component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom ResourCVE-2026-18513 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
- Product
- Maximo Application Suite - Location Service for Esri Component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system.CVE-2026-105052 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
- Product
- Maximo Application Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026OWASP Coraza WAF is a golang modsecurity compatible web application firewall library.CVE-2026-41510 · Other software · corazawaf · reported by GitHubHigh 7.2
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw is triggered when an unauthenticated attacker sends more arguments than SecArgumentsLimit or supplies bodies that expand beyond the configured argument and flattening budgets. An unauthenticated attacker can flood requests with arguments so excess values are silently omitted from ARGS, ARGS_GET, ARGS_NAMES, ARGS_GET_NAMES, ARGS_POST, or ARGS_PATH before security rules inspect them; affected urlencoded and JSON processing can also consume excessive memory. The omission can bypass WAF rules protecting the downstream application, and unbounded or amplified argument processing can cause memory consumption and service degradation. This issue is fixed in version 3.8.1.
- Product
- coraza
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026OWASP Coraza WAF is a golang modsecurity compatible web application firewall library.CVE-2026-104774 · Other software · corazawaf · reported by GitHubMedium 5.8
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggered when a rule relies on t:jsDecode and the request contains JavaScript octal escape sequences. An unauthenticated attacker can encode attack syntax with JavaScript octal escapes so the backend decodes the intended bytes while Coraza rules using t:jsDecode inspect corrupted null-byte output. The mismatch can bypass WAF rules and expose the protected application to attacks such as cross-site scripting or SQL injection. This issue is fixed in version 3.8.0.
- Product
- coraza
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.CVE-2026-107226 · Other software · AsyncHttpClient · reported by GitHubMedium 6.8
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can consequently plant, replace, or remove cookie state later sent to an HTTPS origin, enabling session fixation, CSRF-token replacement, or loss of security-relevant state. This issue is fixed in version 3.0.14.
- Product
- async-http-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, tCVE-2026-109448 · Other software · PostgreSQL · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 5.9
Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps that count to -32768. Binding parameter 32769 then writes about 2.5 MB of zeros starting 1.25 MB before the binding array, which crashes the application or leaves it running on a corrupted heap. Applications that build parameter lists from untrusted input, such as an IN (?, ?, ...) list, are exposed. Versions before psqlODBC 18.00.0005 are affected.
- Product
- psqlODBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in thCVE-2026-48212 · Other software · OTRS GmbH (former OTRS AG) · reported by security@otrs.comMedium 4.8
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.CVE-2026-21138 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.9
Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.
- Product
- Smart Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Oct 12, 2026Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.CVE-2026-21136 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.8
Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.
- Product
- Smart Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Oct 12, 2026Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.CVE-2026-21127 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.9
Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.
- Product
- Samsung Account
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Oct 11, 2026ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run underCVE-2026-108981 · WordPress plugins & themes · reported by MITRELow 3.6
ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)
- Fixed in
- 3.0.4
- What to do
- Update the plugin to 3.0.4 or newer.
Oct 11, 2026GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component.CVE-2026-107437 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 6.2
GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered through static analysis of the distributed binary and may also be exposed in process memory during runtime.
- Product
- GV-E-map Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applicationCVE-2026-108864 · Other software · iflytek · reported by VulnCheckLow 2.3
iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume content into victim workflows and read their continuation output stream, breaking cross-tenant isolation.
- Product
- astron-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials byCVE-2026-108862 · Other software · APIParkLab · reported by VulnCheckMedium 6
APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query /api/v1/app/authorization or its details route to retrieve plaintext API keys regardless of HideCredential.
- Product
- APIPark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mCVE-2026-108714 · Other software · modelcontextprotocol · reported by VulnCheckHigh 8.7
MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB over one or a few connections, forcing huge heap allocations and causing denial of service.
- Product
- kotlin-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages CVE-2026-108641 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded /sys/sysAnnouncementSend/list endpoint and supply them as the sendId parameter to retrieve message titles, bodies, senders and recipients.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintendedCVE-2026-108585 · Other software · argoproj-labs · reported by VulnCheckMedium 5.3
argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositories/ to send authenticated DELETE requests deleting repositories, clusters, or projects within the token's RBAC permissions.
- Product
- argocd-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.CVE-2026-108502 · Other software · ZTE · reported by psirt@zte.com.cnLow 3.3
ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.
- Product
- Z80 Ultra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves.CVE-2026-108265 · Other software · Privasys · reported by GitHubCritical 9.1
Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in wasm-v0.40.0.
- Product
- enclave-os-mini
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Shiny for Python is a framework for building interactive web applications in Python.CVE-2026-108258 · Other software · posit-dev · reported by GitHubMedium 6.9
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied state_id and joins it into the server-side shiny_bookmarks directory without validating that it is a single safe path segment. An unauthenticated request can use parent-directory segments or an absolute path to make the server open input.json and values.json outside the bookmark store, even when bookmark_store is set to disable. In applications configured with bookmark_store set to server and using ui.input_file(), the restore handler can additionally copy and expose an attacker-selected file from an attacker-selected directory. This issue is fixed in version 1.6.4.
- Product
- py-shiny
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Mindwtr is a free offline-first task management application for desktop and mobile.CVE-2026-107857 · Other software · dongdongbh · reported by GitHubMedium 4.4
Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr_cloud_token and @mindwtr_webdav_password. A party with access to the application database or an exposed device backup can recover these credentials and use them to access the user's synchronized tasks and attachments. This issue is fixed in version 1.1.5.
- Product
- Mindwtr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications.CVE-2026-107856 · Other software · civiform · reported by GitHubMedium 4.5
CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester's trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen's name and email address, for accounts outside the intermediary's group. This issue is fixed in version 3.33.0.
- Product
- civiform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026OWASP Coraza WAF is a golang modsecurity compatible web application firewall library.CVE-2026-107835 · Other software · corazawaf · reported by GitHubMedium 4
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie names differently from several backend cookie parsers. An unauthenticated attacker can craft a Cookie header so Coraza indexes or drops a cookie under a different name or value from the backend application, causing rules targeting REQUEST_COOKIES or REQUEST_COOKIES_NAMES to miss application-visible attacker data. Exploitation depends on the backend parser and affected rule scope, and interior control characters with inconsistent backend behavior are outside this advisory's remediation. This issue is fixed in version 3.8.1.
- Product
- coraza
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026OWASP Coraza WAF is a golang modsecurity compatible web application firewall library.CVE-2026-107834 · Other software · corazawaf · reported by GitHubMedium 5.3
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each temporary-file descriptor remains open until the complete request returns. An unauthenticated attacker can submit a multipart body containing many minimal file parts and exhaust the process file-descriptor table within the request-body size limit, causing os.CreateTemp failures, MULTIPART_STRICT_ERROR responses, blocked legitimate uploads, and process-wide inability to open files or sockets. This issue is fixed in version 3.8.0.
- Product
- coraza
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026OWASP Coraza WAF is a golang modsecurity compatible web application firewall library.CVE-2026-107833 · Other software · corazawaf · reported by GitHubMedium 5.9
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. Request JSON processing is not affected by this specific path because it uses the configured request recursion limit, and exploitation requires response-body inspection to be enabled. This issue is fixed in version 3.8.0.
- Product
- coraza
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026OWASP Coraza WAF is a golang modsecurity compatible web application firewall library.CVE-2026-107826 · Other software · corazawaf · reported by GitHubHigh 7.5
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An unauthenticated attacker can submit shallow values followed by an extremely deeply nested JSON tail that was not visited by the bounded walk, causing gjson.Valid to recurse without a depth bound and terminate the hosting process with an unrecoverable fatal stack overflow. The ProcessRequest and ProcessResponse JSON paths share the affected readJSON validation flow, and the payload can remain within recommended body-size and argument-count limits. This issue is fixed in version 3.8.1.
- Product
- coraza
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026OWASP Coraza WAF is a golang modsecurity compatible web application firewall library.CVE-2026-107825 · Other software · corazawaf · reported by GitHubMedium 4
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERY_STRING, ARGS_GET, ARGS_GET_NAMES, and the GET-derived portion of ARGS empty. An unauthenticated attacker can place control bytes in a URI passed directly by integrations such as coraza-spoa, coraza-proxy-wasm, custom FFI hosts, or WASM hosts, causing Coraza to omit query parameters that the downstream integration may still process and allowing rules targeting those variables to be bypassed. The bundled coraza/v3/http integration is not affected because Go net/http rejects such malformed request targets before calling Coraza. This issue is fixed in version 3.8.0.
- Product
- coraza
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases.CVE-2026-107819 · Other software · MariaDB · reported by GitHubMedium 5.9
MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.
- Product
- server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook tCVE-2026-96396 · Other software · canva · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Medium 4.9
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash.
- Product
- affinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generaCVE-2026-96394 · Other software · canva · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Low 2.9
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory in the rendered thumbnail or preview image, or cause the thumbnail or preview extension to crash.
- Product
- affinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity documeCVE-2026-103220 · Other software · canva · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Medium 4.5
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted pointer. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in memory corruption or an application crash.
- Product
- affinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity documeCVE-2026-101130 · Other software · canva · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Low 3.6
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
- Product
- affinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in AffinitCVE-2026-101094 · Other software · canva · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Low 3.6
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
- Product
- affinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026A flaw was found in ansible-core.CVE-2026-89091 · Other software · Red Hat · reported by Red HatHigh 8.8
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory. This allows an attacker who can get a victim to install a malicious collection to overwrite arbitrary files with the privileges of the user running ansible-galaxy, leading to code execution on the control node. This is a bypass of the fix for CVE-2020-10691.
- Product
- Migration Toolkit for Applications 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 8, 2026Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via thCVE-2026-107797 · Other software · banq · reported by VulnCheckMedium 5.3
Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string literals to execute arbitrary JavaScript in the victim's session.
- Product
- jivejdon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that allCVE-2026-107796 · Other software · banq · reported by VulnCheckMedium 5.3
Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that allows unauthenticated attackers to inject script via unencoded tagID and count parameters. Attackers can craft a link with a script-closing payload in tagID or count, triggered when start exceeds zero, to execute JavaScript in victims' browsers.
- Product
- jivejdon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression elCVE-2026-106435 · Other software · MongoDB · reported by cna@mongodb.comMedium 5.9
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.
- Product
- Python Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases.CVE-2026-107385 · Other software · mariadb-corporation · reported by GitHubHigh 7.4
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO_BACKSLASH_ESCAPES mode, including in Connection.escape(). When that mode is enabled, the backslash is an ordinary character, so an attacker-controlled placeholder value can close the SQL string literal and inject arbitrary SQL with the application's database privileges. The vulnerable configuration may be enabled server-wide, through connector initialization options, or with an application-issued SET sql_mode; execute() and batch() use binary protocols and are not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
- Product
- mariadb-connector-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases.CVE-2026-107384 · Other software · mariadb-corporation · reported by GitHubHigh 8.1
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier and cause the remainder of the key to be interpreted as SQL. This can update columns the application did not intend to expose and can append arbitrary SQL with the database user's privileges. The option is disabled by default, and serialized-object handling used when it is disabled is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
- Product
- mariadb-connector-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases.CVE-2026-107383 · Other software · mariadb-corporation · reported by GitHubHigh 7.5
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users' content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
- Product
- mariadb-connector-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases.CVE-2026-107382 · Other software · mariadb-corporation · reported by GitHubMedium 5.9
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash() through Authentication.validateFingerPrint, but Ed25519PasswordAuth.hash() references a seed identifier that is not in scope. Exposure requires a MariaDB server reached over TCP, TLS enabled with ssl: true or an ssl object whose rejectUnauthorized value is not false, a password set, no ssl.ca configured, and client_ed25519 negotiated as the authentication plugin. Under those conditions, a legitimate server, malicious server, or network attacker presenting a self-signed certificate can reach this path and cause a synchronous ReferenceError to escape the socket data handler. Under Node.js default uncaught-exception behavior, the client process terminates, causing denial of service. Configurations using a provided CA, rejectUnauthorized: false, another authentication plugin, or a Unix socket do not reach this vulnerable path. This issue is fixed in version 3.5.4.
- Product
- mariadb-connector-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.