Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
175 results · page 1 of 4
Oct 29, 2026Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.CVE-2026-62001 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.
- Affected
- up to 1.2.14
- What to do
- Affects up to 1.2.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 allows unauthorizeCVE-2026-107039 · Other software · reported by MITREHigh 7.5
Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 allows unauthorized attackers to arbitrarily force a device reset or Denial of Service (DoS).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated uCVE-2026-115453 · Websites & servers · MarcosCamara01 · reported by 4daa8cea-433a-44bd-9456-53b127fc289aHigh 7.1
Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete(), cartRepository.updateQuantityInternal() and wishlistRepository.delete() in src/lib/db/drizzle/repositories/ match rows by primary key alone, with no predicate on the owning user, and the per user authorization for those three operations rests on PostgreSQL row level security. The migrations run ALTER TABLE ... ENABLE ROW LEVEL SECURITY and create policies comparing app.current_user_id() with user_id, but never ALTER TABLE ... FORCE ROW LEVEL SECURITY, and PostgreSQL does not apply policies to the role that owns a table. The template uses one DATABASE_URL both to run the migrations, which create the tables, and for the application at runtime, so the application connects as the owner of the tables and the policies do not apply to it. cart_items.id and wishlist.id are sequential bigserial values, so the identifiers of rows belonging to other users can be enumerated, and the update path returns the modified row, which carries
- Product
- Ecommerce Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user wiCVE-2026-115450 · Websites & servers · MarcosCamara01 · reported by 4daa8cea-433a-44bd-9456-53b127fc289aHigh 7.1
External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list.
- Product
- Ecommerce Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files wiCVE-2026-110648 · Other software · adamarcanov · reported by VulnCheckHigh 8.5
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.
- Product
- compress-fonts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108385 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108384 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type's aliases value directly into a generated types.confixed annotation. A list is represented with quoted entries, but a bare string is emitted as an unquoted Python expression and evaluated when the generated module is imported, allowing arbitrary code execution from a crafted schema. Version 0.70.6 fixes the vulnerability by rejecting aliases values that are not lists.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108383 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member reference after applying case conversion but without validating it as an identifier. Newlines, operators, and punctuation can escape the intended reference and inject constrained statements into the generated module, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating enum defaults as names.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108382 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates each schema-controlled enum symbol between double quotes in a generated enum assignment. When generator classes are used directly, a quote can terminate the string literal and inject arbitrary Python code into the enum class body, which executes when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping enum symbol values before rendering them.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108381 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108380 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108379 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's namespace value between quotes inside a generated types.confixed annotation without escaping or validating it. A crafted quote can terminate the namespace string and alter the surrounding annotation expression, which Python evaluates when the generated class is defined, allowing arbitrary code execution. Version 0.70.6 fixes the vulnerability by requiring the namespace to be a dot-separated sequence of valid Avro names.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108378 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a schema record's doc value into a generated triple-double-quoted class docstring without escaping quotes or backslashes. A crafted triple-quote sequence can close the docstring and inject statements into the generated class body, while a trailing backslash can escape the generated closing delimiter, allowing Python code execution during module import. Version 0.70.6 fixes the vulnerability by escaping quotes, backslashes, and unsafe control characters before rendering docstrings.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108377 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro record name into the quoted Meta.schema_name field of generated Python source without escaping it. A crafted name can terminate the string literal and inject statements into the generated class body, which execute when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108376 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled referenced record name into the callable position of a generated default_factory lambda without validating it as an Avro name. A crafted record name can become an arbitrary Python expression that executes when an instance of the generated model consumes the field default. Version 0.70.6 fixes the vulnerability by rejecting record names that do not match the Avro name grammar.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108375 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module, which execute when the module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackerCVE-2026-109967 · Other software · marcopiovanello · reported by VulnCheckHigh 8.7
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.
- Product
- yt-dlp-web-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a daCVE-2026-109966 · Other software · marcopiovanello · reported by VulnCheckMedium 6.9
yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/ws to make yt-dlp load attacker-chosen JSON files from the server filesystem, with contents reflected in responses.
- Product
- yt-dlp-web-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks.CVE-2026-109568 · Other software · MarceauKa · reported by VulnCheckHigh 7.1
Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/{link,story,chest,album}/{id} with numeric IDs to overwrite or delete other users' content, including private items.
- Product
- Shaark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme mayCVE-2026-108913 · Other software · Omarchy · reported by MITREHigh 7.1
omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.
- Product
- Omarchy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2.CVE-2026-101281 · Other software · Trusted Domain Project · reported by VulDBMedium 5.5
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_sp2_find_mailfrom_domain of the file libopendmarc/opendmarc_spf.c of the component SPF Macro Handler. This manipulation causes improper authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: c48a74c758677fc5272a73eff15ffdbf8afda1a6. Applying a patch is the recommended action to fix this issue.
- Product
- OpenDMARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2.CVE-2026-101280 · Other software · Trusted Domain Project · reported by VulDBMedium 5.5
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OpenDMARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2.CVE-2026-101279 · Other software · Trusted Domain Project · reported by VulDBMedium 5.5
A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file libopendmarc/opendmarc_policy.c of the component DMARC Parser. The manipulation of the argument pct leads to integer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OpenDMARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2.CVE-2026-101278 · Other software · Trusted Domain Project · reported by VulDBLow 2.1
A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_tld.c : of the component PSL Wildcard Handler. Executing a manipulation can lead to origin validation error. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OpenDMARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara0CVE-2026-91154 · Websites & servers · MarcosCamara01 · reported by 4daa8cea-433a-44bd-9456-53b127fc289aMedium 6.9
Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cache at will. The file declares "use server" at file scope, so every exported function compiles into a POST-invokable Server Action; revalidateProducts calls updateTag("products") with no session or role check, unlike the read-only actions in the same file which are safe by construction. Two client components under src/components/admin import the function, which causes its Server Action id to be compiled into a public /_next/static chunk that the application's admin middleware (proxy.ts) does not gate, so any unauthenticated user can extract that id from the public bundle and invoke the action directly. With cacheComponents enabled, the entire storefront (home, categories, product pages, search) is served from "use cache" entries produced by getAllProducts, getCategoryProducts and getProduct, all tagged products with an hours-long cacheLife. Repeated unauthenticated invocation of revalida
- Product
- Ecommerce Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2.CVE-2026-101017 · Other software · Trusted Domain Project · reported by VulDBMedium 5.5
A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. This vulnerability affects the function strcasecmp in the library libopendmarc/opendmarc_policy.c. The manipulation results in handling of exceptional conditions. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OpenDMARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2.CVE-2026-101016 · Other software · Trusted Domain Project · reported by VulDBMedium 5.5
A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_policy_parse_dmarc in the library libopendmarc/opendmarc_policy.c. The manipulation of the argument fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to handling of exceptional conditions. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OpenDMARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2.CVE-2026-101015 · Other software · Trusted Domain Project · reported by VulDBMedium 5.5
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OpenDMARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2.CVE-2026-101014 · Other software · Trusted Domain Project · reported by VulDBMedium 5.5
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae. To fix this issue, it is recommended to deploy a patch.
- Product
- OpenDMARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2026A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2.CVE-2026-100891 · Other software · Trusted Domain Project · reported by VulDBMedium 5.5
A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is the function opendmarc_policy_query_dmarc in the library libopendmarc/opendmarc_policy.c of the component Internationalized Domain Name Handler. Such manipulation leads to encoding error. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OpenDMARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2026A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2.CVE-2026-100890 · Other software · Trusted Domain Project · reported by VulDBMedium 5.5
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OpenDMARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4.CVE-2026-93371 · Other software · marcopiovanello · reported by VulDBMedium 5.5
A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897. A patch should be applied to remediate this issue.
- Product
- yt-dlp-web-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /aCVE-2026-90896 · Websites & servers · MarcosCamara01 · reported by 4daa8cea-433a-44bd-9456-53b127fc289aHigh 8.2
Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a valid Stripe Checkout Session id (cs_...) to retrieve the full session object, including the buyer's name, email, phone, billing address, amount paid and internal userId, because the GET handler calls stripe.checkout.sessions.retrieve() and returns the result without checking for an authenticated session or session ownership. Sibling endpoints such as POST /api/stripe/payment already enforced authentication via auth.api.getSession(); this endpoint had no access control whatsoever. The session_id is exposed in the buyer's own browser URL after payment (success_url = /result?session_id={CHECKOUT_SESSION_ID}), so it leaks through Referer headers, analytics tools, server access logs and shared-machine browser history, resulting in disclosure of the buyer's personal data to an unauthenticated actor.
- Product
- Ecommerce Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026A vulnerability was detected in marcobambini Gravity up to 0.9.7.CVE-2026-90716 · Other software · marcobambini · reported by VulDBLow 2
A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.8 will fix this issue. The patch is named 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6. It is recommended to upgrade the affected component.
- Product
- Gravity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026A security vulnerability has been detected in marcobambini Gravity up to 0.9.7.CVE-2026-90715 · Other software · marcobambini · reported by VulDBMedium 5.5
A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity_json.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.8 mitigates this issue. The name of the patch is 9b337c3eae5833c3956bed1fc01c21c14fd443f2. Upgrading the affected component is recommended.
- Product
- Gravity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026A weakness has been identified in marcobambini Gravity up to 0.9.7.CVE-2026-90714 · Other software · marcobambini · reported by VulDBLow 2.1
A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.8 is sufficient to resolve this issue. Patch name: 9b337c3eae5833c3956bed1fc01c21c14fd443f2. It is suggested to upgrade the affected component.
- Product
- Gravity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject.CVE-2026-82521 · Other software · domainaware · reported by VulnCheckMedium 6.3
parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes the resulting file to be written outside the intended samples directory. An attacker who can cause a forensic failure report with a crafted Subject to be processed can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. Exploitation requires that file output for forensic report samples is enabled.
- Product
- parsedmarc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size.CVE-2026-82520 · Other software · domainaware · reported by VulnCheckHigh 8.7
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.
- Product
- parsedmarc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upCVE-2026-52101 · Other software · reported by MITRECritical 9.1
An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upload.go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary code via the uploadPutHCVE-2026-52100 · Other software · reported by MITREHigh 7.5
Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary code via the uploadPutHandler function
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026An issue in the uploadPostHandler component of Andrei Marcu linx-server v2.3.8 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.CVE-2026-50879 · Other software · reported by MITREHigh 7.5
An issue in the uploadPostHandler component of Andrei Marcu linx-server v2.3.8 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 29, 2026Free MP3 CD Ripper 2.8 contains a stack-based buffer overflow vulnerability in WMA file processing that allows local attackers to bypass DEP protection via struCVE-2018-25383 · Other software · Commentcamarche · reported by VulnCheckHigh 8.6
Free MP3 CD Ripper 2.8 contains a stack-based buffer overflow vulnerability in WMA file processing that allows local attackers to bypass DEP protection via structured exception handling manipulation. Attackers can craft a malicious WMA file that triggers the overflow when loaded through the Convert function, enabling execution of arbitrary code through ROP chain gadgets and shellcode injection.
- Product
- Free MP3 CD Ripper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommentcamarche.netexploit-db.com
May 29, 2026Roslyn CodeLens MCP Server is a Roslyn-based MCP server providing semantic code intelligence for .NET codebases.CVE-2026-45555 · Other software · MarcelRoozekrans · reported by GitHubHigh 7.8
Roslyn CodeLens MCP Server is a Roslyn-based MCP server providing semantic code intelligence for .NET codebases. From 0.0.9 to 1.17.0, the get_diagnostics MCP tool loads and executes all DiagnosticAnalyzer assemblies referenced by the target solution without any allowlist, signature check, or user confirmation; includeAnalyzers defaults to true, so no explicit opt-in is required. An attacker who can place a malicious .csproj referencing an attacker-controlled DLL in a location the victim opens with the MCP server will achieve arbitrary code execution in the server process with the server's OS privileges. This vulnerability is fixed in 1.17.0.
- Product
- roslyn-codelens-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Automad is a flat-file content management system and template engine.CVE-2026-45332 · Other software · marcantondahmen · reported by GitHubHigh 7.5
Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.
- Product
- automad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Comarch ERP Optima client makes use of a hard-coded password for a database user.CVE-2025-68421 · Other software · Comarch · reported by cvd@cert.plHigh 8.7
Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. It is possible for a remote attacker to gain an access to the database with elevated privileges including executing system commands on a server. This issue has been fixed in version 2026.4
- Product
- ERP Optima
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in.CVE-2025-68420 · Other software · Comarch · reported by cvd@cert.plHigh 7.5
Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in. It is possible for a local attacker who controls the client process to dump it's memory, extract credentials and use them to gain a privileged access to the database. In order to exploit this vulnerability, the client application has to be already configured, but a user does not have to be logged in. This issue has been fixed in version 2026.4
- Product
- ERP Optima
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Creolabs Gravity before 0.9.6 contains a heap buffer overflow vulnerability in the gravity_vm_exec function that allows attackers to write out-of-bounds memory CVE-2026-40504 · Other software · marcobambini · reported by VulnCheckCritical 9.3
Creolabs Gravity before 0.9.6 contains a heap buffer overflow vulnerability in the gravity_vm_exec function that allows attackers to write out-of-bounds memory by crafting scripts with many string literals at global scope. Attackers can exploit insufficient bounds checking in gravity_fiber_reassign() to corrupt heap metadata and achieve arbitrary code execution in applications that evaluate untrusted scripts.
- Product
- gravity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Marcell: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28095 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Marcell marcell allows PHP Local File Inclusion.This issue affects Marcell: from n/a through <= 1.2.14.
- Product
- Marcell
- Affected
- up to 1.2.14
- What to do
- Affects up to 1.2.14. Update Marcell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability.CVE-2026-2039 · Other software · GFI · reported by zdi-disclosures@trendmicro.comCritical 9.8
GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the MArc.Store.Remoting.exe process, which listens on port 8018. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-28597.
- Product
- Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability.CVE-2026-2038 · Other software · GFI · reported by zdi-disclosures@trendmicro.comCritical 9.8
GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the MArc.Core.Remoting.exe process, which listens on port 8017. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-27934.
- Product
- Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.