Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
380 results · page 1 of 8
Oct 12, 2026LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because CVE-2026-109206 · Other software · LogicalDOC · reported by VulnCheckMedium 6.9
LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet (/avatar) performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compare 1x1 transparent images against real avatars to enumerate users and retrieve profile pictures.
- Product
- LogicalDOC Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files CVE-2026-109205 · Other software · LogicalDOC · reported by VulnCheckHigh 8.7
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.
- Product
- LogicalDOC Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery ticketCVE-2026-109204 · Other software · LogicalDOC · reported by VulnCheckMedium 5.3
LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.
- Product
- LogicalDOC Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download reCVE-2026-109203 · Other software · LogicalDOC · reported by VulnCheckHigh 7.1
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its versions from folders they cannot access.
- Product
- LogicalDOC Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restCVE-2026-109202 · Other software · LogicalDOC · reported by VulnCheckHigh 7.1
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive.
- Product
- LogicalDOC Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to accCVE-2026-109201 · Other software · LogicalDOC · reported by VulnCheckHigh 8.7
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.
- Product
- LogicalDOC Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet hrCVE-2026-109200 · Other software · LogicalDOC · reported by VulnCheckMedium 5.3
LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http, ftp, file, or jar URLs, forcing server requests and applying attacker-controlled XSLT during conversion.
- Product
- LogicalDOC Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity tCVE-2026-109199 · Other software · LogicalDOC · reported by VulnCheckHigh 8.7
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.
- Product
- LogicalDOC Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries vCVE-2026-109170 · Other software · LogicalDOC · reported by VulnCheckHigh 7.1
LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and read-permission checks, listing restricted document metadata and extracting database contents.
- Product
- LogicalDOC Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter paramCVE-2026-109169 · Other software · LogicalDOC · reported by VulnCheckHigh 7.1
LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.
- Product
- LogicalDOC Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USECVE-2026-93582 · Other software · OTRS GmbH (former OTRS AG) · reported by security@otrs.comCritical 9.4
The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped to corresponding HTTP_* environment variables. As a result, an unauthenticated remote attacker can supply a crafted Remote-User request header which is exposed to the application as HTTP_REMOTE_USER. When HTTP Basic Authentication is configured as the authentication backend, OTRS trusts this value as an already authenticated username and does not perform an additional password verification. An attacker may therefore authenticate through the Generic Interface as an existing agent or customer user without knowing the corresponding credentials. The resulting privileges depend on the account being impersonated. Successful exploitation may allow access to confidential information and modification of data or configuration with the permissions of the affected user. Exploitation requires HTTP Basic Authentication to be configured as an authentication backend and a web server environment in which attacker-controlled HTTP headers are exp
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribCVE-2026-102626 · Other software · LimeSurvey · reported by help@fluidattacks.comHigh 7.2
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted inline JavaScript literal without JavaScript-context encoding.
- Product
- LimeSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-71542 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 8.7
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting (XSS) in the "Theme to Components" functionality (admin/components.php) via the title parameter. The stored title is rendered inside a double-quoted HTML attribute in the administrative interface through an output path that HTML-entity-decodes the value before printing it, without re-encoding for the attribute context. This allows persistent execution of arbitrary JavaScript in the admin panel. At time of publication, there are no publicly available patches.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-71426 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 7.1
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is passed unsanitized to a PHP include() when the page is rendered. Because the include path is never confined, this allows directory-traversal Local File Inclusion: arbitrary local files are included (and, if they contain PHP, executed) when any visitor requests the page. At time of publication, there are no publicly available patches.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-70650 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 8.8
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting (XSS) vulnerability exists in the page backup viewer (admin/backup-edit.php). Page fields are correctly HTML-encoded when a page is saved, but the backup viewer decodes them again (htmldecode() / strip_decode()) and prints the result without re-escaping. A user who can edit a page can store JavaScript in a page's Keywords, Description, Menu text or Content; it executes in the browser of any administrator who later views that page's backup, in the context of the admin control panel. At time of publication, there are no publicly available patches.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-56662 · Other software · GetSimpleCMS-CE · reported by GitHubCritical 9.6
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that auto-submits a forged POST to the update endpoint; when an authenticated administrator visits it, the server performs an attacker-directed download-and-deploy operation in the administrator's session — with no further interaction. Because the deployed content is executed (see the related ZIP-extraction advisory), this yields remote code execution. The url field is additionally written into the form unescaped, providing a secondary HTML-injection sink via a malicious upgrade.json. This issue has been patched in version 1.5.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-56661 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 7.5
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with file_get_contents() after only format validation (FILTER_VALIDATE_URL) — there is no validation of the request destination. An attacker who can submit the form can make the server issue requests to arbitrary destinations, including internal-only services and cloud metadata endpoints (169.254.169.254). The fetched response body is written to a web-accessible file (/Tmpfile.zip) and is not deleted when the content is not a valid ZIP, turning this into a full-read SSRF: the attacker can retrieve the response of the internal request directly. This issue has been patched in version 1.5.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-56660 · Other software · GetSimpleCMS-CE · reported by GitHubCritical 9.1
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to be processed achieves remote code execution as the web-server user. Entry names are also used unsafely, allowing directory traversal (../) to write files outside the intended extraction directory. This issue has been patched in version 1.5.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-53953 · Other software · GetSimpleCMS-CE · reported by GitHubCritical 9.1
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary password and immediately stores its hash as the user's new password. The temporary password is generated using PHP rand() seeded with microtime(). Because this seed is time-based and has a limited effective search space, an attacker can generate possible reset password candidates. Since the admin login endpoint does not enforce rate limiting or account lockout, these candidates can be tested online until the correct password is found. Successful exploitation may lead to administrator account takeover. At time of publication, there are no publicly available patches.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question orCVE-2026-97685 · Other software · LimeSurvey · reported by help@fluidattacks.comHigh 7.1
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the survey ID in the request URL, but the vulnerable persistence operations resolve the target object independently by its global qid or aid and never verify that it belongs to that authorized survey.
- Product
- LimeSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Sep 23, 2026LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.CVE-2026-92730 · Other software · LimeSurvey · reported by help@fluidattacks.comHigh 7.4
LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.
- Product
- LimeSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Sep 23, 2026LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resultinCVE-2026-91775 · Other software · LimeSurvey · reported by help@fluidattacks.comHigh 7.4
LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.
- Product
- LimeSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Sep 11, 2026GitLab Community Edition and Enterprise Edition Path Traversal VulnerabilityCVE-2026-85706 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedCritical 10
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
- Product
- Community Edition and Enterprise Edition
- On CISA’s list since
- Sep 11, 2026 (federal fix deadline Sep 14, 2026)
- What to do
- Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggitlab.comhackerone.com
Sep 11, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-53952 · Other software · GetSimpleCMS-CE · reported by GitHubCritical 9.8
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administrator account. The application features an automated security control designed to delete the sensitive `admin/setup.php` file post-installation. However, this control is neutralized by a self-exclusion bug within the deletion logic, leaving the setup script accessible for unauthorized account creation even after a legitimate installation is completed. As of time of publication, no known patched versions are available.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026WP BackItUp Community Edition: Directory TraversalCVE-2026-18386 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backup_file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The basename() normalization present in the handler only executes when the traversed target path does not exist, providing no protection against reads of existing files.
- Product
- WP BackItUp Community Edition
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP BackItUp Community Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 31, 2026FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint.CVE-2026-79483 · Other software · reported by MITREMedium 5.3
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat history titles of all users across the platform.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint.CVE-2026-65931 · Other software · LimeSurvey · reported by help@fluidattacks.comMedium 5.1
LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey menu entries without the expected settings:update privilege. The endpoint also allows the attacker to submit menu IDs that the normal interface and intended update workflow restrict for non-superadministrators, enabling unauthorized changes to administrative navigation records. This issue affects LimeSurvey: 7.0.5.
- Product
- LimeSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Aug 26, 2026LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administratiCVE-2026-65930 · Other software · LimeSurvey · reported by help@fluidattacks.comMedium 4.8
LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor.This issue affects LimeSurvey: 7.0.5.
- Product
- LimeSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Aug 26, 2026LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint.CVE-2026-63360 · Other software · LimeSurvey · reported by help@fluidattacks.comHigh 7.4
LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This issue affects LimeSurvey: 7.0.5.
- Product
- LimeSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Aug 26, 2026LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow.CVE-2026-16809 · Other software · LimeSurvey · reported by help@fluidattacks.comHigh 7.2
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5.
- Product
- LimeSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Aug 26, 2026LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page.CVE-2026-15973 · Other software · LimeSurvey · reported by help@fluidattacks.comHigh 8.4
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the global settings:read permission can create a survey menu entry containing attacker-controlled data. The value is stored in the surveymenu_entries.data field and later inserted into a single-quoted HTML title attribute without context-appropriate encoding. This issue affects LimeSurvey: 7.0.5.
- Product
- LimeSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Aug 25, 2026In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`, a constant that isCVE-2026-79788 · Other software · dradis · reported by VulnCheckHigh 7.1
In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated (non-admin) user can create an AI provider pointing to an arbitrary HTTP/HTTPS address (including internal/link-local hosts such as http://169.254.169.254) and reassign the built-in Roslin agent to use it. When an AI interaction is triggered, the server issues a request to the attacker-supplied URL (server-side request forgery). For non-2xx responses, the target's response body is reflected verbatim to the attacker's browser via ActionCable/Turbo Stream error messages, making the SSRF readable.
- Product
- dradis-ce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitraryCVE-2026-53804 · Other software · Centuran Consulting · reported by VulnCheckHigh 8.6
OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration values are concatenated without sanitization into a shell command, enabling arbitrary command execution as the web server process user during normal ticket operations after the malicious configuration is deployed.
- Product
- OTRS Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh00die-gr3y.github.iovulncheck.com
Aug 19, 2026HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow.CVE-2026-18756 · Other software · HumHub · reported by help@fluidattacks.comHigh 7.2
HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated non-member into submitting the legitimate membership request form, and cause the server to return JavaScript containing attacker-controlled code.
- Product
- HumHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Aug 19, 2026HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.CVE-2026-18526 · Other software · HumHub · reported by help@fluidattacks.comHigh 7.4
HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.
- Product
- HumHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Aug 14, 2026LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey CVE-2026-18403 · Other software · LimeSurvey · reported by help@fluidattacks.comMedium 6
LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.
- Product
- LimeSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Aug 14, 2026LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint.CVE-2026-63361 · Other software · LimeSurvey · reported by help@fluidattacks.comHigh 8.5
LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding.
- Product
- LimeSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Aug 13, 2026Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameteCVE-2026-73671 · Other software · Saurus · reported by VulnCheckMedium 5.1
Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path enforcement. Attackers can craft a malicious logout URL containing an arbitrary external domain or javascript: URI scheme to redirect authenticated users to attacker-controlled phishing pages after session destruction, enabling credential theft and OAuth redirect abuse.
- Product
- Saurus CMS Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMCVE-2026-73670 · Other software · Saurus · reported by VulnCheckHigh 8.6
A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the table_name GET or POST parameter. Attackers can perform table traversal, time-based blind, boolean-based blind, and error-based injection techniques to enumerate full database schema, access system tables such as information_schema, and chain the disclosure with secondary injection points to extract credential data.
- Product
- Saurus CMS Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints.CVE-2026-19113 · Other software · HashiCorp · reported by security@hashicorp.comMedium 5.3
Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CACVE-2026-19017 · Other software · HashiCorp · reported by security@hashicorp.comMedium 6.8
Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with `operator:write` permission may direct Consul to read and forward credential files outside the intended scope, potentially leading to the exfiltration of sensitive secrets from the Consul server host. This vulnerability, CVE-2026-19017, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submittCVE-2026-19016 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.2
Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpointCVE-2026-19015 · Other software · HashiCorp · reported by security@hashicorp.comMedium 5.3
Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-19015, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization enCVE-2026-19014 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.3
Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-190124, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition CVE-2026-19012 · Other software · HashiCorp · reported by security@hashicorp.comMedium 5.3
Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can submit a service-router configuration entry that causes the agent to exit unexpectedly. This vulnerability, CVE-2026-19012, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptanCVE-2026-15972 · Other software · HashiCorp · reported by security@hashicorp.comHigh 7.5
Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured wiCVE-2026-15970 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.2
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format.CVE-2026-26081 · Other software · HAProxy · reported by MITREMedium 4.8
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
- Product
- HAProxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.haproxy.orghaproxy.org
Jul 20, 2026HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled.CVE-2026-26080 · Other software · HAProxy · reported by MITRELow 3.7
HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.
- Product
- HAProxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.haproxy.orghaproxy.org
Jul 8, 2026Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACVE-2026-55761 · Other software · portainer · reported by GitHubHigh 7.1
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 through 2.39.3 and 2.40.0 until 2.43.0, unauthenticated restore and administrator initialization endpoints (/api/restore and /api/users/admin/init) remain accessible during the five-minute setup window for uninitialized instances, allowing a network attacker to restore a crafted backup or create the first administrator account and gain full administrative access. This issue is fixed in versions 2.39.4 and 2.43.0.
- Product
- portainer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.