Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,349 results · page 81 of 767
Aug 18, 2026SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into CVE-2026-74902 · Other software · siyuan-note · reported by VulnCheckCritical 9.3
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 18, 2026Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by preCVE-2026-75627 · Other software · bastillion-io · reported by VulnCheckCritical 9.3
Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.
- Product
- Bastillion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata.CVE-2026-75626 · Other software · smicallef · reported by VulnCheckCritical 9.3
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.
- Product
- spiderfoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP.CVE-2026-34884 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue.
- Product
- Apache SkyWalking MCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 18, 2026Forminator Forms: Arbitrary File UploadCVE-2026-15748 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
- Product
- Forminator Forms
- Affected
- up to 1.56.1
- What to do
- Affects up to 1.56.1. Update Forminator Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 17, 2026An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationConteCVE-2026-67919 · Other software · reported by MITRECritical 9.8
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 17, 2026Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the bacCVE-2026-42164 · Other software · reported by MITRECritical 9.8
Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page CVE-2026-42162 · Other software · reported by MITRECritical 9.1
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute aCVE-2026-38165 · Other software · reported by MITRECritical 9.8
A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Onyx is an open-source AI platform.CVE-2026-71424 · Other software · onyx-dot-app · reported by GitHubCritical 9.6
Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and _db_mcp_server_to_api_mcp_server returns that row through auth_template.headers to any BASIC_ACCESS user. This issue is fixed in versions 3.1.10, 3.2.14, and 4.0.0.
- Product
- onyx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentContrCVE-2026-67960 · Other software · reported by MITRECritical 9.8
An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems processing.CVE-2026-67868 · Other software · reported by MITRECritical 9.8
A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems processing. This allows a remote attacker to execute arbitrary code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary codeCVE-2026-67854 · Other software · reported by MITRECritical 9.8
SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026MLflow Server-Side Request Forgery VulnerabilityCVE-2026-64849 · Other software · MLflow · reported by GitHubExploitedCritical 9.3
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
- Product
- MLflow
- On CISA’s list since
- Aug 19, 2026 (federal fix deadline Sep 2, 2026)
- What to do
- Attackers are using this now. Install MLflow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Aug 17, 2026An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA privatCVE-2026-51977 · Other software · reported by MITRECritical 9.1
An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstanceCVE-2026-42163 · Other software · reported by MITRECritical 9.8
Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026MemOS is a memory operating system for LLMs and AI agents.CVE-2026-75110 · Other software · MemTensor · reported by VulnCheckCritical 9.3
MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is then treated as a trusted internal principal and granted scopes: ["all"]. As a result, an unauthenticated remote attacker can reach the admin API-key management endpoints to mint API keys for any user, enumerate keys, revoke keys, and generate a master key for persistent privileged access, as well as all data endpoints.
- Product
- MemOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compCVE-2026-75106 · Other software · OpnForm · reported by VulnCheckCritical 9.3
OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.
- Product
- OpnForm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code.CVE-2026-67967 · Other software · reported by MITRECritical 9.8
Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access.CVE-2026-67966 · Other software · reported by MITRECritical 9.8
Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login functionCVE-2026-67965 · Other software · reported by MITRECritical 9.8
An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat ModuleCVE-2026-67926 · Other software · reported by MITRECritical 9.8
An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality.CVE-2026-67917 · Other software · reported by MITRECritical 9.8
zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The `azuracast:restore` command executes the `db.sql` file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate privileges
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026A flaw was found in the managedcluster-import-controller.CVE-2026-66795 · Other software · Red Hat · reported by Red HatCritical 9.9
A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.
- Product
- multicluster engine for Kubernetes 2.10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 17, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-65974 · Other software · frappe · reported by GitHubCritical 9.9
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0.
- Product
- erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026vm2 is an open source vm/sandbox for Node.js.CVE-2026-47698 · Other software · patriksimek · reported by GitHubCritical 9.8
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and reach e.constructor.constructor for arbitrary host command execution. This issue is fixed in version 3.11.6.
- Product
- vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026vm2 is an open source vm/sandbox for Node.js.CVE-2026-47686 · Other software · patriksimek · reported by GitHubCritical 9.9
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process from an embedder-exposed host function that throws an error with that object as its cause and then execute arbitrary host commands. This issue is fixed in version 3.11.6.
- Product
- vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, dup_wcs componeCVE-2026-39255 · Other software · reported by MITRECritical 9.8
Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, dup_wcs components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, CxAudioHidDevicCVE-2026-39254 · Other software · reported by MITRECritical 9.8
Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, CxAudioHidDevice::DeviceGetDescriptionString components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026A flaw was found in acm-search-v2-rhel9.CVE-2026-71472 · Other software · Red Hat · reported by Red HatCritical 9.1
A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) editor, to inject malicious shell commands or SQL statements. This occurs because the WORK_MEM string provided in the Search CR is not properly validated before being used in a bash script and an SQL query. Successful exploitation could lead to arbitrary code execution within the privileged postgres pod, potentially compromising the system.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 17, 2026An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level securityCVE-2026-68004 · Other software · reported by MITRECritical 9.8
An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration (security.enabled), SrsSecurity::check(), trunk/src/app/srs_app_security.cpp, and SRS RTMP listener components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary codeCVE-2026-67678 · Other software · reported by MITRECritical 9.8
File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 CVE-2026-19478 · Websites & servers · GitLab · reported by cve@gitlab.comCritical 9.4
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.gitlab.comgitlab.com
Aug 17, 2026A flaw was found in the multicloud-operators-subscription component.CVE-2026-66792 · Other software · Red Hat · reported by Red HatCritical 9.9
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.
- Product
- Multicluster Global Hub 1.4.9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 17, 2026A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the server retrieving an image from a crafted URL, and it fails CVE-2026-50775 · Other software · reported by MITRECritical 9.8
A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the server retrieving an image from a crafted URL, and it fails to return the content or any errors directly.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role.CVE-2026-50774 · Other software · reported by MITRECritical 9.8
An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related CVE-2026-74254 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the styles model. Version 3.6.4 fixed the vector in the frontend, 3.6.5 in the backend.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0 - Regular Labs Sourcerer before 16.0.0 prCVE-2026-74253 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0 - Regular Labs Sourcerer before 16.0.0 processes {source} blocks found in Joomla’s final rendered HTML without reliably determining where that code originated.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive informaCVE-2026-51346 · Other software · reported by MITRECritical 9.1
SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store() functions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.studip.desimon.hilchenba.ch
Aug 17, 2026An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function.CVE-2026-50772 · Other software · reported by MITRECritical 9.8
An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.squirro.comgithub.com
Aug 17, 2026An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request.CVE-2026-50770 · Other software · reported by MITRECritical 9.8
An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.squirro.comgithub.com
Aug 17, 2026The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection (time-based) vulnerability.CVE-2026-50769 · Other software · reported by MITRECritical 9.8
The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection (time-based) vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is vulnerable to SQL injection allowing an attacker to execute arbitrary code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.combrainformatik.com
Aug 17, 2026In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signatureCVE-2026-75045 · Other software · JetBrains · reported by cve@jetbrains.comCritical 9.1
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.CVE-2026-71479 · Other software · QuantumNous · reported by GitHubCritical 9.1
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversions in common/quota_math.go and related settlement paths, allowing a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds. This issue is fixed in version 1.0.0-rc.18.
- Product
- new-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.CVE-2026-64859 · Other software · QuantumNous · reported by GitHubCritical 9.1
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"), allowing an authenticated administrator to obtain the root user's bearer token and access root-only system configuration APIs. This issue is fixed in version 1.0.0-rc.7.
- Product
- new-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Discourse is an open-source discussion platform.CVE-2026-55674 · Other software · discourse · reported by GitHubCritical 9.3
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered into a color scheme tag without escaping, the attacker could break out of the attribute and inject a tag that bypassed Discourse's nonce-based Content Security Policy, resulting in arbitrary JavaScript execution in visitors' browsers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026FakeFish handles incoming credentials by passing them down to scripts.CVE-2026-71566 · Other software · openshift-metal3 · reported by 74b3a70d-cca6-4d34-9789-e83b222ae3beCritical 9.3
FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the user that created fakefish, power them on and off, and mount arbitrary CD images to them.
- Product
- fakefish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd.CVE-2026-14564 · Other software · Innotim Software Telecommunications and Consulting Trade Ltd. Co. · reported by iletisim@usom.gov.trCritical 9
Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114.
- Product
- Logsign SIEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922.CVE-2026-74843 · Other software · Wavlink · reported by VulDBCritical 9.3
A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi of the component Export Pingortrace CGI. Executing a manipulation of the argument HTTP_COOKIE can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
- Product
- WN531P3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticCVE-2026-74901 · Other software · jahlives · reported by VulnCheckCritical 9.3
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.
- Product
- openssl_encrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.