Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,298 results · page 1 of 346
Nov 9, 2026FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitializedCVE-2026-125099 · Other software · FFmpeg · reported by VulnCheckMedium 4.8
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to copy uninitialized heap memory into decoded frames, disclosing heap contents.
- Product
- FFmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.ffmpeg.orggithub.com
Nov 9, 2026NASA JPL ION-DTN 3.6.2 through 4.2.0 contains a heap-based buffer overflow in the Network Management daemon (nm_mgr) string-formatting logic that allows a malicCVE-2026-123999 · Other software · nasa-jpl · reported by VulnCheckHigh 8.7
NASA JPL ION-DTN 3.6.2 through 4.2.0 contains a heap-based buffer overflow in the Network Management daemon (nm_mgr) string-formatting logic that allows a malicious or misconfigured agent to trigger an out-of-bounds write by sending deeply nested AMP payloads that exceed fixed-size buffer allocations through unbounded strcat operations. Attackers can transmit oversized AMP reports, tables, or macros over the UDP CLA/AMP path or trigger the flaw locally via interactive UI rendering to crash nm_mgr and cause a denial of service halting telemetry collection and operator visibility.
- Product
- ION-DTN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypCVE-2026-115337 · Other software · Progress Software · reported by security@progress.comMedium 6.3
Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users.
- Product
- WS_FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Nov 9, 2026Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research InstitCVE-2026-94434 · Other software · TÜBİTAK BİLGEM Software Technologies Research Institute · reported by iletisim@usom.gov.trHigh 8.8
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9.
- Product
- Pardus Boot Repair
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885.CVE-2026-124621 · Other software · kongxin-github · reported by VulDBLow 2.1
A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Book.modifybook/Book.deletebook/Category.addcategory/Category.setcategory/Landing.sureadmin of the file src/view/MainInterface.java of the component Swing UI Layer. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Java_Library_Management_System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026RSVP and Event Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-121570 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill RSVP and Event Management rsvp allows Stored XSS.This issue affects RSVP and Event Management: from n/a through 2.7.17.
- Product
- RSVP and Event Management
- Affected
- up to 2.7.17
- What to do
- Affects up to 2.7.17. Update RSVP and Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2026Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Privilege Abuse.CVE-2026-94249 · Other software · TÜBİTAK BİLGEM Software Technologies Research Institute · reported by iletisim@usom.gov.trHigh 8.1
Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Privilege Abuse. This issue affects Liderahenk: before 2.0.3.
- Product
- Liderahenk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer allows Leveraging TCVE-2026-92606 · Other software · TÜBİTAK BİLGEM Software Technologies Research Institute · reported by iletisim@usom.gov.trMedium 6
Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue affects Pardus MyComputer: from 0.8.0 before 0.8.1.
- Product
- Pardus MyComputer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026GemBooking: Does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilitiesCVE-2026-123131 · WordPress plugins & themes · reported by WPScanMedium 5.9
The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and update the site's settings.
- Product
- GemBooking
- Fixed in
- 1.7.1
- What to do
- Update GemBooking to 1.7.1 or newer.
Nov 9, 2026GemBooking: Does not serialise concurrent booking requests per team memberCVE-2026-123128 · WordPress plugins & themes · reported by WPScanLow 3.7
The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.
- Product
- GemBooking
- Fixed in
- 1.7.1
- What to do
- Update GemBooking to 1.7.1 or newer.
Nov 8, 2026A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3.CVE-2026-124502 · Other software · yungifez · reported by VulDBLow 2.1
A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded.
- Product
- Skuul School Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 8, 2026A vulnerability was determined in Convene Azeus Convene Board Management Portal 7.0.2.7_3 p72.CVE-2026-124498 · Other software · Convene · reported by VulDBLow 2
A vulnerability was determined in Convene Azeus Convene Board Management Portal 7.0.2.7_3 p72. The impacted element is an unknown function of the file /jsp/ge/dummy_launcher.jsp. Executing a manipulation of the argument REDIRECT_URL can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Azeus Convene Board Management Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Nov 8, 2026IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumptioCVE-2026-96146 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
- Product
- SevOne Network Performance Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2026IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a local attacker to execute arbitrary code due to a buffer overflow.CVE-2026-95867 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.7
IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a local attacker to execute arbitrary code due to a buffer overflow.
- Product
- SevOne Network Performance Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2026IBM Controller Disclosure Management 1.0.0.0 could allow an attacker to obtain sensitive EXIF metadata from uploaded images due to improper removal of sensitiveCVE-2026-12735 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Controller Disclosure Management 1.0.0.0 could allow an attacker to obtain sensitive EXIF metadata from uploaded images due to improper removal of sensitive information before storage.
- Product
- Controller Disclosure Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2026IBM Storage Copy Data Management 2.2.0.0 through 2.3.1.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the systCVE-2026-119670 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Storage Copy Data Management 2.2.0.0 through 2.3.1.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.
- Product
- Storage Copy Data Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2026IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server to return contents of a sensitive requesteCVE-2024-41786 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server to return contents of a sensitive requested file due to improper input validation.
- Product
- Engineering Requirements Management DOORS Next
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2026Sync Post With Other Site: Does not properly authorize a content-management action for post types other than pagesCVE-2026-110132 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify arbitrary custom post types, including reassigning content authorship.
- Product
- Sync Post With Other Site
- Fixed in
- 1.9.4
- What to do
- Update Sync Post With Other Site to 1.9.4 or newer.
Nov 7, 2026OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 ideCVE-2026-123548 · Other software · OpenIdentityPlatform · reported by VulnCheckLow 2.3
OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Nov 7, 2026A flaw was found in the Keycloak server's client management component.CVE-2026-120984 · Other software · Red Hat · reported by Red HatCritical 9.1
A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. This allows an authenticated attacker with client management permissions to bypass security controls and upload a malicious JavaScript policy, which is then executed on the server when an authorization request is made. Successful exploitation could allow the attacker to run arbitrary code on the server, potentially compromising the entire system.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow arbitrary code to be executed by the management service in certain non-defaCVE-2026-105002 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow arbitrary code to be executed by the management service in certain non-default configurations due to improper control of generation of code. Customization content may be evaluated as code, which is only possible where the related feature is enabled and not properly restricted.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data.CVE-2026-55649 · Other software · GeoNode · reported by GitHubMedium 6.3
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another user's browser when the document page is visited. This issue is fixed in version 5.0.3.
- Product
- geonode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data.CVE-2026-46429 · Other software · GeoNode · reported by GitHubMedium 5.5
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, specially crafted requests can circumvent GeoNode upload service validation, allowing a low-privileged remote user to store and serve malicious files. This issue is fixed in version 5.0.3.
- Product
- geonode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data.CVE-2026-33050 · Other software · GeoNode · reported by GitHubHigh 8.8
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.
- Product
- geonode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a CVE-2026-107155 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 8.8
A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
- Product
- SonicOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.com
Nov 6, 2026A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unautCVE-2026-107154 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 8.8
A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
- Product
- SonicOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.com
Nov 6, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-bCVE-2026-92080 · Other software · TÜBİTAK BİLGEM Software Technologies Research Institute · reported by iletisim@usom.gov.trMedium 4.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal. This issue affects pardus-boot-repair: from 1.0.8 before 1.1.0.
- Product
- pardus-boot-repair
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-bCVE-2026-105422 · Other software · TÜBİTAK BİLGEM Software Technologies Research Institute · reported by iletisim@usom.gov.trMedium 6.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal. This issue affects pardus-boot-repair: from 1.0.9 before 1.1.0.
- Product
- pardus-boot-repair
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role fromCVE-2026-88801 · WordPress plugins & themes · reported by WPScanHigh 8
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated user, such as a subscriber, to inject arbitrary web scripts which execute when an administrator opens one of the standard user management screens.
- Affected
- up to 1.7.8.7
- What to do
- Affects up to 1.7.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability checkCVE-2026-88800 · WordPress plugins & themes · reported by WPScanCritical 9.1
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.
- Affected
- up to 1.7.8.7
- What to do
- Affects up to 1.7.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their cCVE-2026-88799 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.
- Affected
- up to 1.7.8.7
- What to do
- Affects up to 1.7.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution.CVE-2026-97848 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources.
- Product
- Red Hat build of Keycloak 26.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 6, 2026A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution.CVE-2026-96547 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials could create a client that incorrectly maps standard user profile information to sensitive security roles, potentially allowing them to gain unauthorized privileges on external applications that trust Keycloak tokens.
- Product
- Red Hat build of Keycloak 26.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 6, 2026A flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution.CVE-2026-96447 · Other software · Red Hat · reported by Red HatMedium 4.2
A flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution. The issue occurs during the validation of stateless access tokens when the original user ID no longer exists. Keycloak incorrectly falls back to using the username to identify the user without verifying if the identity matches the original token subject. This could allow an attacker with an old token to gain access to a newly created service account if it shares the same client ID as a previously deleted one.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 6, 2026A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution.CVE-2026-92856 · Other software · Red Hat · reported by Red HatMedium 4.9
A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution. The issue occurs when Keycloak acts as an intermediary between an upstream identity provider and downstream services. Keycloak fails to respect specific security instructions called ProxyRestrictions in the login messages it receives. This allows a user to log into downstream services even when the original identity provider explicitly forbade further sharing of the login session. As a result, users can bypass security boundaries intended to limit where their identity can be used.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 6, 2026A flaw was found in the Admin REST API of Keycloak, an identity and access management solution.CVE-2026-19688 · Other software · Red Hat · reported by Red HatMedium 6.8
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 5, 2026Rucio is a scientific data management framework.CVE-2026-58273 · Other software · rucio · reported by GitHubHigh 8.1
Rucio is a scientific data management framework. From 1.16.1 until 35.9.0, 38.6.0, and 41.0.0rc1, the /credentials/signurl endpoint reads X-Rucio-Account instead of the account stored in request.environ['issuer'] by token authentication. Any authenticated low-privilege user can supply root as the header value and pass the root-only get_signed_url permission check. The server then returns a presigned read, write, or delete URL for an attacker-selected object using stored S3, GCS, or Swift credentials, and X-Rucio-VO can select another tenant in multi-VO deployments. This permits data disclosure, modification, deletion, and cross-tenant access on cloud-backed RSEs. This issue is fixed in versions 35.9.0, 38.6.0, and 41.0.0rc1.
- Product
- rucio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026Dolibarr is an open-source enterprise resource planning and customer relationship management application.CVE-2026-33944 · Other software · Dolibarr · reported by GitHubHigh 8.8
Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the localtax1_value and localtax2_value properties into an SQL UPDATE statement without numeric conversion or other appropriate sanitization. An authenticated user with Third Party create or edit permission can submit crafted lt1 or lt2 POST parameters to read sensitive database information, including password hashes, API keys, and business data, or modify third-party records. This issue is fixed in versions 22.0.5 and 23.0.2.
- Product
- dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-65983 · Other software · openemr · reported by GitHubHigh 7.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custom_modules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::get_data() and SignalWireClient::uploadFileForFax() writes the plaintext bytes under sites/{siteId}/fax. The module returns the resulting public URL to SignalWire, protects it only with a predictable uniqid() filename, and never removes the staged file. An unauthenticated network actor who obtains or guesses the URL can retrieve persistent patient documents even when drive encryption is enabled. This issue is fixed in version 8.2.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-115573 · Other software · openemr · reported by GitHubHigh 8.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLER_ACL_MAP, and checkControllerAcl() returns without enforcing any permission for those entries. A low-privilege authenticated user can invoke C_X12Partner::edit_action_process() to create or alter insurance-routing hosts and credentials, or invoke C_PatientFinder::find_action_process() to enumerate patient names, dates of birth, and identifiers. The shared fail-open dispatcher root cause also exposes other administrative controllers that were intended to be reached through ACL-gated Practice Settings routes. This issue is fixed in version 8.3.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-104139 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/set_pt.php allows any authenticated user to set an arbitrary patient identifier in the active session without an ACL check, and interface/patient_file/download_template.php trusts that session value while enforcing only CSRF validation. A low-privilege user can select another patient and download a rendered document template containing the patient's demographics, encounter information, allergies, medications, and problem list despite lacking patients/docs access. This issue is fixed in version 8.3.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-104138 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajax_download.php, custom/download_qrda.php, custom/export_qrda_xml.php, and custom/qrda_download.php validate CSRF but do not enforce the patients/med ACL used by the canonical CQM report page. The endpoints also accept an unscoped report_id, allowing a low-privilege authenticated user to reach report generation and download logic for other reports. In a clinic with generated CQM reports, this can expose QRDA Category One and Category Three clinical documents for patients in a measure. This issue is fixed in version 8.3.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-104137 · Other software · openemr · reported by GitHubHigh 7.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information. This issue is fixed in version 8.3.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-104136 · Other software · openemr · reported by GitHubHigh 7.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the new_recall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege authenticated user who knows or enumerates a patient identifier can retrieve patient details, contact fields, HIPAA notification preferences, recent appointment information, and existing recall information. This issue is fixed in version 8.3.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-104135 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/payment_ajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patient_data. Any authenticated user, including a non-clinical role, can enumerate patient identifiers, full names, and dates of birth through the set_patient branch. This issue is fixed in version 8.3.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-104134 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the search_persons action in library/ajax/person_search_ajax.php validates CSRF but does not perform an AclMain authorization check before searching the person and patient_data tables. A low-privilege authenticated user can iterate name prefixes and receive patient first and last names, dates of birth, gender, phone numbers, and email addresses in JSON responses. This issue is fixed in version 8.3.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-104133 · Other software · openemr · reported by GitHubHigh 7.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custom_modules/oe-module-dorn/public/compendium_install.php checks authentication and CSRF but does not require the admin/users ACL enforced by sibling DORN administration scripts. When the DORN module is enabled, a low-privilege authenticated user can supply a labGuid that causes LabCompendiumInstall::uninstall() to delete detail and result procedure types and deactivate order types before the reinstall step. The action can corrupt lab-ordering configuration and require an administrator to restore the compendium. This issue is fixed in version 8.3.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-103939 · Other software · openemr · reported by GitHubMedium 5.4
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custom_modules/oe-module-weno/scripts/file_download.php has no ACL or CSRF check and ignores the result of validateAdminCredentials(). When the Weno module is enabled, the default GET path calls PharmacyService::removeWenoPharmacies() before attempting a refetch, allowing any authenticated user to truncate the weno_pharmacy table and allowing a cross-site request to trigger the same operation through a logged-in victim. A failed later download can leave the e-prescribing pharmacy directory empty and unavailable. This issue is fixed in version 8.3.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-103938 · Other software · openemr · reported by GitHubHigh 7.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/patient_file/pos_checkout_ippf.php performs state-changing void, voidall, and regen operations through GET requests without CSRF token validation. The form_checksum integrity check is conditional and is skipped when the parameter is omitted, allowing a cross-site request to force an authenticated billing user to void checkouts or regenerate invoice counters. The resulting changes can alter ledger state, financial reporting, and audit records. This issue is fixed in version 8.3.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-103935 · Other software · openemr · reported by GitHubHigh 8.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and codetext values with text(), which uses ENT_NOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form. Successful exploitation can expose session data and protected health information or permit patient-record actions in the victim's session. This issue is fixed in version 8.3.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.