Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
54,594 results · page 1 of 1092
Oct 29, 2026WeGIA is a web manager for charitable institutions.CVE-2026-61719 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.9
WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuarios.php` arises because the `textoProntuario` field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through `POST /controle/control.php` with `nomeClasse=SaudeControle`, `metodo=alterarProntuario`, and `id_fichamedica`. The stored content is rendered when another user accesses `/html/saude/historico_prontuarios.php` with `id_historico`, automatically executing attacker-controlled JavaScript in the victim's browser. The vulnerability permits session cookie theft and potential account compromise depending on the victim's privileges. This issue is fixed in version 3.8.7.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026WeGIA is a web manager for charitable institutions.CVE-2026-61673 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.3
WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field. The affected flow spans `web/controle/memorando/DespachoControle.php` and `web/dao/memorando/DespachoDAO.php`: `FILTER_SANITIZE_SPECIAL_CHARS` is applied during storage, but `html_entity_decode()` later decodes the stored content and `jQuery .html()` inserts the result into the DOM. An attacker able to submit a memorandum dispatch through `/controle/control.php` using `DespachoControle` and `metodo=incluir` can store malicious HTML or JavaScript. The code executes automatically when another user views the memorandum thread through `/html/memorando/listar_despachos.php` with `id_memorando`. This permits arbitrary JavaScript execution, theft of administrator `PHPSESSID` session tokens, privileged session hijacking, account takeover, and unauthorized access to privileged or internal functionality. This issue is fixed in version 3.8.7.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026WeGIA is a web manager for charitable institutions.CVE-2026-61671 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.1
WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `extract($_REQUEST)`, including id, `idatendido`, `idInterno`, and `id_funcionario`, while the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. `AtendidoControle` lacks ownership checks on alterar, excluir, `listarUm`, `alterarInfPessoal`, `alterarDocumentacao`, `alterarImagem`, `alterarEndereco`, and `alterarStatus`; `InternoControle` lacks them on incluir, alterar, excluir, `listarUm`, `listarTodos`, and `listarCpf`. `FuncionarioControle` lacks ownership checks on `alterarInfPessoal`, `alterarEndereco`, `alterarDocumentacao`, `alterarImagem`, `alterarCargaHoraria`, and excluir; `VoluntarioControle` lacks them on `alterarInfPessoal`, `alterarEndereco`, `alterarDetalhes`, `alterarImagem`, and excluir. `AtendidoControle` and `InternoControle` additionally lack CSRF validat
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-45049 · Other software · OpenIdentityPlatform · reported by GitHubHigh 8.3
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026PHPUnit is a testing framework for PHP.CVE-2026-119193 · Other software · sebastianbergmann · reported by GitHubMedium 5.4
PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory() logic in src/Runner/Phpt/TestCase.php creates temporary files for PHPT code coverage in a predictable phpunit-phpt directory under sys_get_temp_dir() and reuses that directory without verifying its ownership or permissions. On multi-user systems with a shared temporary path, a local attacker who creates the directory before the developer runs PHPT tests with code coverage can replace the generated job file before the child process executes it with require, allowing arbitrary code execution with the developer's privileges while the test and coverage report appear successful. PHPUnit 12.5 and earlier, default macOS and Windows configurations with per-user temporary directories, and single-user environments where another user cannot create files in the temporary path are not affected. This issue is fixed in 13.4.4.
- Product
- phpunit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate prCVE-2026-119251 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Medium 6.7
A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host device.
- Product
- WiFiman Desktop for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS tCVE-2026-119250 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984High 7.8
A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device.
- Product
- WiFiman Desktop for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop for macOS to obtain inCVE-2026-119249 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984High 7.5
A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop for macOS to obtain information about the host device.
- Product
- WiFiman Desktop for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon databaseCVE-2026-11587 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7High 7.2
SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database
- Product
- Centreon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthewatch.centreon.comundefined
Oct 29, 2026Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM CVE-2026-107051 · Other software · reported by MITRE
Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.CVE-2026-107047 · Other software · reported by MITREHigh 7.5
Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport CVE-2026-107044 · Other software · reported by MITRE
Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgf-droid.org
Oct 29, 2026Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.CVE-2026-107043 · Other software · reported by MITRE
Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 andCVE-2026-90872 · Other software · Progress Software · reported by security@progress.comMedium 6.6
Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
- Product
- WS_FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprogress.lightning.force.com
Oct 29, 2026An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command executCVE-2026-90868 · Other software · Progress Software · reported by security@progress.comCritical 9.9
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
- Product
- WS_FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprogress.lightning.force.com
Oct 29, 2026An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command executCVE-2026-90865 · Other software · Progress Software · reported by security@progress.comCritical 9
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
- Product
- WS_FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprogress.lightning.force.com
Oct 29, 2026Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.CVE-2026-42701 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.
- Affected
- up to 4.4.6
- What to do
- Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.CVE-2026-118079 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.
- Affected
- up to 8.3.4
- What to do
- Affects up to 8.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.CVE-2026-118078 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.CVE-2026-118074 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
- Affected
- up to 2.21.0
- What to do
- Affects up to 2.21.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.CVE-2026-116869 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.CVE-2026-110309 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation ofCVE-2026-107028 · Other software · reported by MITRE
Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.CVE-2026-103092 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Broken Function Level Authorization allows execution of poller post-restart commands by authenticated userCVE-2025-13050 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7Medium 5.4
Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user
- Product
- Centreon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthewatch.centreon.comundefined
Oct 29, 2026WP User Manager: Missing AuthorizationCVE-2026-116846 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26.
- Product
- WP User Manager
- Affected
- up to 2.9.26
- What to do
- Affects up to 2.9.26. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Taxi Booking Manager for WooCommerce: Missing AuthorizationCVE-2026-114181 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.6.
- Product
- Taxi Booking Manager for WooCommerce
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's prCVE-2026-107018 · Other software · reported by MITRE
Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39736 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.
- Product
- JetEngine
- Affected
- up to 3.9.0.1
- What to do
- Affects up to 3.9.0.1. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution.CVE-2026-118425 · Other software · Red Hat · reported by Red HatMedium 6.8
A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in anotherCVE-2026-113697 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 4.8
Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link.
- Product
- BMC Helix Operations Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated useCVE-2026-113696 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 5.3
Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows aCVE-2026-113695 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 4.8
Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated useCVE-2026-113694 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 5.3
Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenCVE-2026-113693 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 5.3
Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administratCVE-2026-113692 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 6.9
Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticaCVE-2026-113691 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 5.1
Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Product Feed Manager: Missing AuthorizationCVE-2026-118093 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1.
- Product
- Product Feed Manager
- Affected
- up to 7.14.1
- What to do
- Affects up to 7.14.1. Update Product Feed Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated useCVE-2026-113690 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 4.8
Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated useCVE-2026-113689 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 5.1
Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authentCVE-2026-113688 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 5.3
Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability.CVE-2026-97854 · Other software · Yamaha Corporation · reported by vultures@jpcert.or.jpCritical 9.3
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.
- Product
- NWR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jprtpro.yamaha.co.jp
Oct 29, 2026open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows anCVE-2026-119025 · Other software · sindresorhus · reported by VulnCheckHigh 7.7
open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.
- Product
- open
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026NewsmanApp: Stored Cross-Site ScriptingCVE-2026-115821 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name, billing_last_name' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Newsman Remarketing feature is enabled and a non-empty Remarketing ID is configured in the plugin settings.
- Product
- NewsmanApp
- Affected
- up to 3.7.29
- What to do
- Affects up to 3.7.29. Update NewsmanApp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 29, 2026Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents.CVE-2026-33924 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comHigh 7.5
Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes arbitrary commands to be executed with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.nozominetworks.com
Oct 29, 2026OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokensCVE-2026-118984 · Other software · cheaper-inference · reported by VulnCheckHigh 7
OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.
- Product
- OmniRoute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026BuddyPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-115965 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.
- Product
- BuddyPress
- Affected
- up to 14.5.2
- What to do
- Affects up to 14.5.2. Update BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Motors: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-115964 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126.
- Product
- Motors
- Affected
- up to 1.4.126
- What to do
- Affects up to 1.4.126. Update Motors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services.CVE-2026-118030 · Other software · Red Hat · reported by Red HatMedium 4.2
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 29, 2026A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution.CVE-2026-117688 · Other software · Red Hat · reported by Red HatMedium 5.3
A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text. This could lead to the exposure of sensitive credentials that the user should not be able to access.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.