Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,841 results · page 9 of 77
Jul 20, 2026Paymenter is a free and open-source webshop solution for management of hosting services.CVE-2026-47198 · Other software · Paymenter · reported by GitHubHigh 8.5
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because bundled server extensions prioritize these user-supplied properties over administrator-defined configurations, a regular user can override hosting plans and resource limits at checkout without special privileges. The Checkout Livewire component's $checkoutConfig property exposed via URL query parameters, only validating keys explicitly defined by an extension's configuration method, allowing any undefined injected keys to bypass validation entirely. These unsanitized keys are then stored directly in the database by the cart component and later passed to server extensions during provisioning, enabling user-injected data to override intended administrator settings. Depending on the active extension, this leads to unauthorized overrides of core resource limits (such as CPU, RAM, storage, or package tiers). No administrative privileges are required to exploit this vulnerability. This issue has bee
- Product
- Paymenter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026Paymenter is a free and open-source webshop solution for management of hosting services.CVE-2026-44585 · Other software · Paymenter · reported by GitHubMedium 5.4
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing services belonging to other accounts by modifying the service ID in the request. An attacker could modify the service ID value in the client-side request and successfully create a ticket associated with another user's service. The vulnerability requires authentication and does not provide direct access to service contents or customer data. However, referenced service information could become visible to support personnel handling the ticket. Successful exploitation could allow an authenticated user to: create support tickets referencing services belonging to other users, potentially cause support staff to interact with or review unrelated customer services. The vulnerability did not allow direct access to another user's service, modification of another user's service or retrieval of confidential service data through the vulnerable endpoint itself. This issue has been fixed in version 1.5.0.
- Product
- Paymenter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026Paymenter is a free and open-source webshop solution for management of hosting services.CVE-2026-44584 · Other software · Paymenter · reported by GitHubMedium 4.3
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified status after switching to an unverified or unowned email address. When a user updated their email address, the system did not reset or revalidate the associated email verification status. As a result, the verification column remained set to “true” even after the email address was changed. Exploitation could potentially result in: misrepresentation of email ownership, bypass of verification-based trust assumptions, and abuse of features gated behind verified status. No direct unauthorized access to other users accounts or data is possible through this issue alone. This issue has been fixed in version 1.5.0.
- Product
- Paymenter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026Paymenter is a free and open-source webshop solution for management of hosting services.CVE-2026-44583 · Other software · Paymenter · reported by GitHubMedium 5.3
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request destinations. This value is passed directly into a server-side HTTP request via file_get_contents, allowing attackers to control the destination of the request. No allowlist, validation, or signature verification is applied to the header before usage. As a result, the application can be coerced into performing HTTP requests to attacker-controlled or internal network destinations. This vulnerability allows remote unauthenticated attackers to induce server-side HTTP GET requests to arbitrary external or internal endpoints. Depending on network configuration, this may lead to: blind SSRF to external attacker-controlled systems, and potential access to internal network services No direct response data is returned to the attacker (blind SSRF), but the issue may still enable sensitive network probing or data exfiltration via side channels. This issue has been fixed in version 1.5.0.
- Product
- Paymenter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and CVE-2026-8297 · Other software · Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 through 08072026.
- Product
- GisLab Laboratory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identitCVE-2026-16104 · Other software · Red Hat · reported by Red HatMedium 4.3
A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys, when they are requested by administrators with view-only permissions. This can lead to the exposure of third-party service credentials to unauthorized personnel or through administrative logs.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 17, 2026A flaw was found in the keycloak-services component of Keycloak.CVE-2026-16103 · Other software · Red Hat · reported by Red HatMedium 4.3
A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler but were omitted from the token redemption handler. This allows an attacker with valid client credentials to obtain access and refresh tokens for a user account that has been locked due to brute-force protection, provided the authentication request was started before the lockout occurred and was approved by the user.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jul 17, 2026Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc.CVE-2026-11763 · Other software · Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. · reported by iletisim@usom.gov.trMedium 6.5
Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows Exploitation of Trusted Identifiers. This issue affects GisLab Laboratory Management System: from 1.4.03 through 08072026.
- Product
- GisLab Laboratory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026A flaw was found in the keycloak-services component of Red Hat Build of Keycloak.CVE-2026-16089 · Other software · Red Hat · reported by Red HatMedium 5.4
A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their own client, potentially allowing them to obtain access tokens for a victim's identity.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 17, 2026A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers.CVE-2026-15943 · Other software · Red Hat · reported by Red HatMedium 5.5
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jul 16, 2026zrok is software for sharing web services, files, and network resources.CVE-2026-45576 · Other software · openziti · reported by GitHubHigh 8.3
zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.WriteStream, allowing the sync pipeline to write files outside the selected local filesystem destination root. This issue is fixed in version 2.0.3.
- Product
- zrok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026zrok is software for sharing web services, files, and network resources.CVE-2026-45568 · Other software · openziti · reported by GitHubCritical 9.9
zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin, allowing the requested path to replace the configured target host and causing requests.request to return a server-side response from an attacker-chosen URL. This issue is fixed in version 2.0.3.
- Product
- zrok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026WPBot – AI ChatBot for Live Support, Lead Generation, AI Services: Authorization bypassCVE-2026-15610 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger arbitrary re-embedding of stored RAG documents, modifying the rag_documents table and consuming the site owner's paid third-party AI API credits (OpenAI, Gemini, OpenRouter, or xAI).
- Product
- WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Affected
- up to 8.5.6
- What to do
- Affects up to 8.5.6. Update WPBot – AI ChatBot for Live Support, Lead Generation, AI Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 16, 2026WPBot – AI ChatBot for Live Support, Lead Generation, AI Services: Authorization bypassCVE-2026-15106 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary chat session records from the wpbot_user and wpbot_conversation tables, including chat history and conversation logs, by supplying a crafted userid value.
- Product
- WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Affected
- up to 8.5.6
- What to do
- Affects up to 8.5.6. Update WPBot – AI ChatBot for Live Support, Lead Generation, AI Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 15, 2026A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to perfCVE-2026-20146 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system to either read or delete arbitrary files. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to access sensitive files or delete arbitrary files on the affected system.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Jul 14, 2026Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackerCVE-2026-36035 · Other software · reported by MITREMedium 6.5
Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service (DoS) via removing the license from the webserver.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcaxperts.commedium.com
Jul 14, 2026sigstore-js provides JavaScript libraries for interacting with Sigstore services.CVE-2026-48816 · Other software · sigstore · reported by GitHubMedium 6.5
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.
- Product
- sigstore-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026sigstore-js provides JavaScript libraries for interacting with Sigstore services.CVE-2026-48815 · Other software · sigstore · reported by GitHubHigh 7.5
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.
- Product
- sigstore-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026sigstore-js provides JavaScript libraries for interacting with Sigstore services.CVE-2026-48758 · Other software · sigstore · reported by GitHubMedium 5.4
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.
- Product
- sigstore-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.CVE-2026-58626 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-58544 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Out-of-bounds read in Active Directory Federation Services (AD FS) allows an authorized attacker to disclose information over a network.CVE-2026-58529 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Out-of-bounds read in Active Directory Federation Services (AD FS) allows an authorized attacker to disclose information over a network.
- Product
- Windows 11 version 26H1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.CVE-2026-54121 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Active Directory Federation Services (AD FS) allows an authorized attackCVE-2026-50684 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.8
Improper neutralization of input during web page generation ('cross-site scripting') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally.CVE-2026-50681 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a neCVE-2026-50647 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5 AND 4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.CVE-2026-50411 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5 AND 4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.CVE-2026-50369 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.CVE-2026-50368 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5 AND 4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.CVE-2026-50366 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Microsoft XML Core Services allows an authorized attacker to elevate privileges locally.CVE-2026-50359 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Microsoft XML Core Services allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.CVE-2026-50355 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5 AND 4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally.CVE-2026-50352 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a neCVE-2026-50324 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5 AND 4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.CVE-2026-50304 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5 AND 4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper certificate validation in Windows Cryptographic Services allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-50302 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.2
Improper certificate validation in Windows Cryptographic Services allows an unauthorized attacker to bypass a security feature over a network.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026sigstore-js provides JavaScript libraries for interacting with Sigstore services.CVE-2026-59891 · Other software · sigstore · reported by GitHubCritical 9.6
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for and transmitted to a different registry whose hostname has a substring relationship with a configured auth key. This issue is fixed in version 0.7.1.
- Product
- sigstore-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.CVE-2026-57976 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability CVE-2026-56155 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.
- Product
- Active Directory Federation Services
- On CISA’s list since
- Jul 14, 2026 (federal fix deadline Jul 28, 2026)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comcisa.gov
Jul 14, 2026Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.CVE-2026-54983 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.CVE-2026-50695 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network.CVE-2026-49178 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.CVE-2026-49164 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.CVE-2026-44806 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication.CVE-2026-10714 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.8
A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication. The vulnerability stems from the application not verifying that the JWT algorithm is configured for RSA, enabling an attacker to set the algorithm to "none" and craft forged tokens. This could allow an authenticated low-privilege user to impersonate any authorized user on the FTSP server, resulting in unauthorized access to system configuration and the ability to grant permissions to other systems protected by FTSP.
- Product
- FactoryTalk® Services Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 13, 2026SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling eCVE-2026-44753 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.7
SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application.
- Product
- SAP HANA Extended Application Services classic model (User Self Service)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available.CVE-2026-59180 · Other software · caronc · reported by GitHubLow 3.1
Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py follow HTTP redirects by default and resend user-configured auth headers and query parameters on the redirected request, allowing a compromised trusted destination or on-path attacker to receive secrets such as Authorization headers, bearer tokens, custom headers, and service keys. This issue is fixed in version 1.11.0.
- Product
- apprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software and Internet Services BiEticaret allows SQCVE-2026-5955 · Other software · Inrove Software and Internet Services · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software and Internet Services BiEticaret allows SQL Injection. This issue affects BiEticaret: before v3.3.57.
- Product
- BiEticaret
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Inrove Software and Internet Services BiEticaret allows ReCVE-2026-5793 · Other software · Inrove Software and Internet Services · reported by iletisim@usom.gov.trMedium 6.1
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Inrove Software and Internet Services BiEticaret allows Reflected XSS. This issue affects BiEticaret: before v3.3.57.
- Product
- BiEticaret
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API CVE-2026-35552 · Other software · reported by MITREHigh 8.1
In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API endpoint intended for privileged users. Due to missing authorization checks, this allows the attacker to deactivate the application's license.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcaxperts.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.