Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,387 results · page 97 of 348
Jan 13, 2026Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorizeCVE-2026-20815 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting to cause a potential use CVE-2025-10865 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceHigh 7.8
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting to cause a potential use after free. Improper reference counting on an internal resource caused scenario where potential for use after free was present.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources reference counting creating a poteCVE-2025-58411 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceHigh 8.8
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources reference counting creating a potential use after free scenario. Improper resource management and reference counting on an internal resource caused scenario where potential write use after free was present.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management moduleCVE-2025-9435 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 5.5
Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module
- Product
- ManageEngine ADManager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a maliciousCVE-2026-0513 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.7
Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site.This causes low impact on integrity of the application. Confidentiality and availability are not impacted.
- Product
- SAP Supplier Relationship Management (SICF Handler in SRM Catalog)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographic algorithm for encrypting User Mapping CVE-2026-0510 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3
The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographic algorithm for encrypting User Mapping data. This weakness could allow an attacker with high-privileged access to exploit the vulnerability under specific conditions potentially leading to partial disclosure of sensitive information.This has low impact on confidentiality with no impact on integrity and availability of the application.
- Product
- NW AS Java UME User Mapping
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST CVE-2026-0504 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.8
Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST requests that are processed by JNDI operations without adequate input neutralization. This may lead to limited disclosure or modification of data, resulting in low impact on confidentiality and integrity, with no impact on application availability.
- Product
- SAP Identity Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an attacker could extract hardcoded clear-teCVE-2026-0503 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.4
Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an attacker could extract hardcoded clear-text credentials and bypass the password authentication check by manipulating user parameters. Upon successful exploitation, the attacker can access, modify or delete certain change pointer information within EHS objects in the application which might further affect the subsequent systems. This vulnerability leads to a low impact on confidentiality and integrity of the application with no affect on the availability.
- Product
- SAP ERP Central Component and SAP S/4HANA (SAP EHS Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.CVE-2026-22804 · Other software · Termix-SSH · reported by GitHubHigh 8
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 to 1.9.0, Stored Cross-Site Scripting (XSS) vulnerability exists in the Termix File Manager component. The application fails to sanitize SVG file content before rendering it. This allows an attacker who has compromised a managed SSH server to plant a malicious file, which, when previewed by the Termix user, executes arbitrary JavaScript in the context of the application. The vulnerability is located in src/ui/desktop/apps/file-manager/components/FileViewer.tsx. This vulnerability is fixed in 1.10.0.
- Product
- Termix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_iCVE-2024-14021 · Other software · run-llama · reported by VulnCheckHigh 8.4
LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who can provide a crafted persist directory containing a malicious pickle file can trigger arbitrary code execution when the victim loads the index from disk.
- Product
- llama_index
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry.CVE-2026-22789 · Other software · SMEWebify · reported by GitHubMedium 5.4
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, WebErpMesv2 contains a file upload validation bypass vulnerability in multiple controllers that allows authenticated users to upload arbitrary files, including PHP scripts, leading to Remote Code Execution (RCE). This vulnerability is identical in nature to CVE-2025-52130 but exists in different code locations that were not addressed by the original fix. This vulnerability is fixed in 1.19.
- Product
- WebErpMesv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry.CVE-2026-22788 · Other software · SMEWebify · reported by GitHubHigh 8.2
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards. This vulnerability is fixed in 1.19.
- Product
- WebErpMesv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Gin-vue-admin is a backstage management system based on vue and gin.CVE-2026-22786 · Other software · flipped-aurora · reported by GitHubHigh 7.3
Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulnerability in the breakpoint resume upload functionality. Attacker can upload any files on any directory. In the breakpoint_continue.go file, the MakeFile function accepts a fileName parameter through the /fileUploadAndDownload/breakpointContinueFinish API endpoint and directly concatenates it with the base directory path (./fileDir/) using os.OpenFile() without any validation for directory traversal sequences (e.g., ../). An attacker with file upload privileges could exploit this vulnerability.
- Product
- gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search.pCVE-2025-67146 · Other software · Abhishekmali21 · reported by MITRECritical 9.4
Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search.php, and (3) gym_search.php, and via the 'id' parameter in (4) payment_search.php. An unauthenticated remote attacker can exploit these issues to inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or modification of database contents.
- Product
- GYM Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Buffer Overflow in the ippprint (Internet Printing Protocol) service in Sagemcom F@st 3686 MAGYAR_4.121.0 allows remote attacker to execute arbitrary code by seCVE-2025-29329 · Other software · Sagemcom · reported by MITRECritical 9.8
Buffer Overflow in the ippprint (Internet Printing Protocol) service in Sagemcom F@st 3686 MAGYAR_4.121.0 allows remote attacker to execute arbitrary code by sending a crafted HTTP request.
- Product
- F@st 3686 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in (1) submit_coCVE-2025-67147 · Other software · reported by MITRECritical 9.8
Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in (1) submit_contact.php, the 'username' and 'pass_key' parameters in (2) secure_login.php, and the 'login_id', 'pwfield', and 'login_key' parameters in (3) change_s_pwd.php. An unauthenticated or authenticated attacker can exploit these issues to bypass authentication, execute arbitrary SQL commands, modify database records, delete data, or escalate privileges to administrator level.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Lychee is a free, open-source photo-management tool.CVE-2026-22784 · Other software · LycheeOrg · reported by GitHubLow 2.3
Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that allows users to gain possibly unauthorized access to other users' password-protected albums. When a user unlocks a password-protected public album, the system automatically unlocks ALL other public albums that share the same password, resulting in a complete authorization bypass. This vulnerability is fixed in 7.1.0.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Imaster's Patient Records Management System is vulnerable to SQL Injection in the endpoint ‘/projects/hospital/admin/complaints.php’ through the ‘id’ parameter.CVE-2025-41004 · Other software · Imaster · reported by cve-coordination@incibe.esHigh 8.7
Imaster's Patient Records Management System is vulnerable to SQL Injection in the endpoint ‘/projects/hospital/admin/complaints.php’ through the ‘id’ parameter.
- Product
- Patient Record Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Imaster's Patient Record Management System contains a stored Cross-Site Scripting (XSS) vulnerability in the endpoint ‘/projects/hospital/admin/edit_patient.phpCVE-2025-41003 · Other software · Imaster · reported by cve-coordination@incibe.esMedium 5.1
Imaster's Patient Record Management System contains a stored Cross-Site Scripting (XSS) vulnerability in the endpoint ‘/projects/hospital/admin/edit_patient.php’. By injecting a malicious script into the ‘firstname’ parameter, the JavaScript code is stored and executed every time a user accesses the patient list, allowing an attacker to execute arbitrary JavaScript in a victim's browser.
- Product
- Patient Record Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2026A security flaw has been discovered in Sangfor Operation and Maintenance Management System up to 3.0.8.CVE-2025-15503 · Other software · Sangfor · reported by VulDBMedium 5.5
A security flaw has been discovered in Sangfor Operation and Maintenance Management System up to 3.0.8. The impacted element is an unknown function of the file /fort/trust/version/common/common.jsp. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Operation and Maintenance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2026A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.8.CVE-2025-15502 · Other software · Sangfor · reported by VulDBMedium 5.5
A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.8. The affected element is the function SessionController of the file /isomp-protocol/protocol/session. Such manipulation of the argument Hostname leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Operation and Maintenance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026October is a Content Management System (CMS) and web platform.CVE-2025-61676 · Other software · octobercms · reported by GitHubMedium 6.1
October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms. A user with the Customize Backend Styles permission could inject malicious HTML/JS into the stylesheet input at Styles from Branding & Appearance settings. A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users. This issue has been patched in versions 3.7.13 and 4.0.12.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026October is a Content Management System (CMS) and web platform.CVE-2025-61674 · Other software · octobercms · reported by GitHubMedium 6.1
October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerability was identified in October CMS backend configuration forms. A user with the Global Editor Settings permission could inject malicious HTML/JS into the stylesheet input at Markup Styles. A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users. This issue has been patched in versions 3.7.13 and 4.0.12.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Ghost is a Node.js content management system.CVE-2026-22597 · Other software · TryGhost · reported by GitHubMedium 5.1
Ghost is a Node.js content management system. In versions 5.38.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF. This issue has been patched in versions 5.130.6 and 6.11.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Ghost is a Node.js content management system.CVE-2026-22596 · Other software · TryGhost · reported by GitHubMedium 6.7
Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in versions 5.130.6 and 6.11.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Ghost is a Node.js content management system.CVE-2026-22595 · Other software · TryGhost · reported by GitHubHigh 8.1
Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had access to these endpoints. This issue has been patched in versions 5.130.6 and 6.11.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Ghost is a Node.js content management system.CVE-2026-22594 · Other software · TryGhost · reported by GitHubHigh 8.1
Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026OpenProject is an open-source, web-based project management software.CVE-2026-22605 · Other software · opf · reported by GitHubMedium 4.3
OpenProject is an open-source, web-based project management software. OpenProject versions prior to version 16.6.3, allowed users with the View Meetings permission on any project, to access meeting details of meetings that belonged to projects, the user does not have access to. This issue has been patched in version 16.6.3.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026OpenProject is an open-source, web-based project management software.CVE-2026-22604 · Other software · opf · reported by GitHubMedium 6.9
OpenProject is an open-source, web-based project management software. For OpenProject versions from 11.2.1 to before 16.6.2, when sending a POST request to the /account/change_password endpoint with an arbitrary User ID as the password_change_user_id parameter, the resulting error page would show the username for the requested user. Since this endpoint is intended to be called without being authenticated, this allows to enumerate the user names of all accounts registered in an OpenProject instance. This issue has been patched in version 16.6.2.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026OpenProject is an open-source, web-based project management software.CVE-2026-22603 · Other software · opf · reported by GitHubMedium 6.9
OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, OpenProject’s unauthenticated password-change endpoint (/account/change_password) was not protected by the same brute-force safeguards that apply to the normal login form. In affected versions, an attacker who can guess or enumerate user IDs can send unlimited password-change requests for a given account without triggering lockout or other rate-limiting controls. This allows automated password-guessing (e.g., with wordlists of common passwords) against valid accounts. Successful guessing results in full account compromise for the targeted user and, depending on that user’s role, can lead to further privilege escalation inside the application. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026OpenProject is an open-source, web-based project management software.CVE-2026-22602 · Other software · opf · reported by GitHubLow 3.5
OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low‑privileged logged-in user can view the full names of other users. Since user IDs are assigned sequentially and predictably (e.g., 1 to 1000), an attacker can extract a complete list of all users’ full names by iterating through these URLs. The same behavior can also be reproduced via the OpenProject API, allowing automated retrieval of full names through the API as well. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026OpenProject is an open-source, web-based project management software.CVE-2026-22601 · Other software · opf · reported by GitHubHigh 8.6
OpenProject is an open-source, web-based project management software. For OpenProject version 16.6.1 and below, a registered administrator can execute arbitrary command by configuring sendmail binary path and sending a test email. This issue has been patched in version 16.6.2.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026OpenProject is an open-source, web-based project management software.CVE-2026-22600 · Other software · opf · reported by GitHubCritical 9.1
OpenProject is an open-source, web-based project management software. A Local File Read (LFR) vulnerability exists in the work package PDF export functionality of OpenProject prior to version 16.6.4. By uploading a specially crafted SVG file (disguised as a PNG) as a work package attachment, an attacker can exploit the backend image processing engine (ImageMagick). When the work package is exported to PDF, the backend attempts to resize the image, triggering the ImageMagick text: coder. This allows an attacker to read arbitrary local files that the application user has permissions to access (e.g., /etc/passwd, all project configuration files, private project data, etc.). The attack requires permissions to upload attachments to a container that can be exported to PDF, such as a work package. The issue has been patched in version 16.6.4. Those who are unable to upgrade may apply the patch manually.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026A vulnerability was determined in Sangfor Operation and Maintenance Management System up to 3.0.8.CVE-2025-15501 · Other software · Sangfor · reported by VulDBHigh 8.9
A vulnerability was determined in Sangfor Operation and Maintenance Management System up to 3.0.8. Impacted is the function WriterHandle.getCmd of the file /isomp-protocol/protocol/getCmd. This manipulation of the argument sessionPath causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Operation and Maintenance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026A vulnerability was found in Sangfor Operation and Maintenance Management System up to 3.0.8.CVE-2025-15500 · Other software · Sangfor · reported by VulDBHigh 8.9
A vulnerability was found in Sangfor Operation and Maintenance Management System up to 3.0.8. This issue affects some unknown processing of the file /isomp-protocol/protocol/getHis of the component HTTP POST Request Handler. The manipulation of the argument sessionPath results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Operation and Maintenance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026A vulnerability has been found in Sangfor Operation and Maintenance Management System up to 3.0.8.CVE-2025-15499 · Other software · Sangfor · reported by VulDBHigh 7.4
A vulnerability has been found in Sangfor Operation and Maintenance Management System up to 3.0.8. This vulnerability affects the function uploadCN of the file VersionController.java. The manipulation of the argument filename leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Operation and Maintenance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 mishandle configuration management.CVE-2025-68719 · Other software · Kaysus · reported by MITREHigh 8.8
KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 mishandle configuration management. Once any user is logged in and maintains an active session, an attacker can directly query the backup endpoint and download a full configuration archive. This archive contains sensitive files such as /etc/shadow, enabling credential recovery and potential full compromise of the device.
- Product
- Ks-wr3600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Kirby is an open-source content management system.CVE-2026-21896 · Other software · getkirby · reported by GitHubMedium 5.8
Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. This vulnerability does not affect those who have not altered the deviated from default user permissions. This issue has been patched in version 5.2.2.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-22255 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow vulnerability in `CIccCLUT::Init()` at `IccProfLib/IccTagLut.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.CVE-2026-22241 · Other software · gunet · reported by GitHubHigh 7.3
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbitrary files on the server's file system. The main cause of the issue is that no validation or sanitization of the file's present inside the zip archive. This leads to remote code execution on the web server. Version 4.2 patches the issue.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Kanboard is project management software focused on Kanban methodology.CVE-2026-21881 · Other software · kanboard · reported by GitHubCritical 9.1
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Kanboard is project management software focused on Kanban methodology.CVE-2026-21880 · Other software · kanboard · reported by GitHubMedium 5.3
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authentication mechanism. User-supplied input is directly substituted into LDAP search filters without proper sanitization, allowing attackers to enumerate all LDAP users, discover sensitive user attributes, and perform targeted attacks against specific accounts. This issue is fixed in version 1.2.49.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Kanboard is project management software focused on Kanban methodology.CVE-2026-21879 · Other software · kanboard · reported by GitHubMedium 4.7
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows malicious actors to redirect authenticated users to attacker-controlled websites. By crafting URLs such as //evil.com, attackers can bypass the filter_var($url, FILTER_VALIDATE_URL) validation check. This vulnerability could be exploited to conduct phishing attacks, steal user credentials, or distribute malware. The issue is fixed in version 1.2.49.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026REDAXO is a PHP-based content management system.CVE-2026-21857 · Other software · redaxo · reported by GitHubHigh 8.3
REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive. Version 5.20.2 fixes this issue.
- Product
- redaxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-22047 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow vulnerability in `SIccCalcOp::Describe()` at `IccProfLib/IccMpeCalc.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-22046 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow vulnerability in `CIccProfileXml::ParseBasic()` at `IccXML/IccLibXML/IccProfileXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21693 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccSegmentedCurveXml::ToXml()` at `IccXML/IccLibXML/IccMpeXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21692 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `ToXmlCurve()` at `IccXML/IccLibXML/IccMpeXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21691 · Other software · InternationalColorConsortium · reported by GitHubMedium 5.4
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccTag:IsTypeCompressed()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21690 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.3
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccTagXmlTagData::ToXml()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.