Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,613 results · page 1 of 93
Oct 28, 2026Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi.CVE-2026-75520 · Other software · domoticz · reported by GitHubMedium 5.4
Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` in `main/LuaHandler.cpp` constructed the filename from the parser directory and the supplied script name before passing it to `luaL_loadfile`. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3.
- Product
- domoticz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-55561 · Other software · InvoicePlane · reported by GitHubMedium 5.3
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The `approve()` and `reject()` methods in the Guest Quotes controller, `application/modules/guest/controllers/Quotes.php`, call `approve_quote_by_id($quote_id)` and `reject_quote_by_id($quote_id)` directly without the `where_in('ip_quotes.client_id', $this->user_clients)` scoping that sibling methods use. A guest user assigned to one client can change another client's quote status by supplying sequential integer `quote_id` values, and `email_quote_status()` also sends notification emails. Additionally, `generate_pdf()` calls `mark_viewed($quote_id)` before checking the client scope, allowing a guest user to mark another client's quote as viewed. These issues are fixed in version 1.7.2-beta-1 and the subsequent stable version 1.7.2.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026FearlessCMS is a flat-file `content` management system centered on simplicity and open source.CVE-2026-63190 · Other software · fearlessgeekmedia · reported by GitHubCritical 9.4
FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or adequate `path` validation. On PHP's built-in development server, including the default Docker deployment, `router.php` checks an unnormalized admin URI prefix while the filesystem resolves dot segments, so `/./admin/` bypasses the admin login gate and executes those scripts directly. In `admin/debug_save_flow.php`, attacker-controlled `path` and `content` reach `file_put_contents` for arbitrary `.md` writes under `content`/ or outside it through `path` traversal, enabling site defacement and stored JavaScript in public pages; `print_r($_POST)` output without `htmlspecialchars` escaping also causes reflected cross-site scripting. The `admin/debug_content.php` `path` parameter reaches `scandir()`, `file_get_contents()` and `posix_getpwuid()`, permitting arbitrary directory enumeration and `.md` file reads that expose absolute paths, ownership, permissions, hashes and `content` previews. The `admin/preview-handler.php` endpoint acc
- Product
- FearlessCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Xibo is an open source digital signage platform with a web content management system and Windows display player software.CVE-2026-50543 · Other software · xibosignage · reported by GitHubMedium 4.3
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing authorization on `POST /displaygroup/criteria/{displayGroupId}` allows an authenticated user to send criteria updates to any display via `XMR`. These criteria determine schedule changes and can alter playback, for example by causing content scheduled for rainy weather to play when it is not raining. Exploitation requires `Schedule Criteria` to be in use on the CMS. This issue is fixed in version 4.4.3.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Xibo is an open source digital signage platform with a web content management system and Windows display player software.CVE-2026-50542 · Other software · xibosignage · reported by GitHubMedium 5.4
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /layout/status/{id}` allow an authenticated user with any privileges to view the `status and metadata` of any layout, including layouts for which the user does not have view rights. This issue is fixed in version 4.4.3.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Xibo is an open source digital signage platform with a web content management system and Windows display player software.CVE-2026-50539 · Other software · xibosignage · reported by GitHubMedium 6.5
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on `/notification/export/{id}` allows an authenticated user to download attachments from any notification, including notifications created by administrators, by iterating over `sequential notification IDs`. Exploitation requires access to the `Notification Centre` to view past notifications, a privilege granted to non-administrators as standard. This issue is fixed in version 4.4.3.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Xibo is an open source digital signage platform with a web content management system and Windows display player software.CVE-2026-52729 · Other software · xibosignage · reported by GitHubHigh 7.1
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `PUT/DELETE /action/{id}` allow an authenticated user to modify or delete actions on any Layout. Exploitation requires the privilege to allow edits, including deletion, to all created Layouts, which is granted to non-administrators as standard. This issue concerns `Layout actions` rather than the separately reported DataSet export vulnerability. This issue is fixed in version 4.4.3.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Xibo is an open source digital signage platform with a web content management system and Windows display player software.CVE-2026-50541 · Other software · xibosignage · reported by GitHubMedium 6.5
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /dataset/export/csv/{id}` allow an authenticated user to export data from any dataset, including datasets created by administrators, by iterating over `sequential dataset IDs`. Exploitation requires access to the privilege allowing edits, including deletion, to all created `DataSets` independently of Layouts. This privilege is not granted to non-administrators as standard. This issue is fixed in version 4.4.3.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation.CVE-2026-118435 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.4
Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation.
- Product
- escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57203 · Other software · asterisk · reported by GitHubMedium 6.9
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `ast_loggrabber` executes a `Python script` from the world-writable `/tmp` directory. An attacker already authorized to open a shell session on the Asterisk server may place a malicious script there and gain elevated privileges or execute code when an administrator runs `ast_loggrabber` as a user with elevated privileges. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57199 · Other software · asterisk · reported by GitHubLow 2.3
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `app_sms.c` copies externally controlled `SMS` lengths into `fixed in-struct buffers` without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The administrator must explicitly use the `SMS` dialplan application, which is useful when routing calls to or from `analog devices`, and must not have ensured that data passed to the application is valid. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57192 · Other software · asterisk · reported by GitHubMedium 6
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds write in the `Codec2` decoder caused by a `floor/ceil sample-count mismatch`. The `codec_codec2` module must be loaded and `Codec2` must be configured on the attacked endpoint. The attacker must pass SIP authentication by username/password or `source IP address matching`, establish a call using `Codec2`, and send carefully crafted `Codec2` audio packets. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57191 · Other software · asterisk · reported by GitHubHigh 8.2
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57190 · Other software · asterisk · reported by GitHubHigh 7
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the `PostgreSQL` and `TDS/MSSQL` Channel Event Log backends `cel_pgsql` and `cel_tds` may permit arbitrary SQL execution when untrusted data is set in the CEL `eventtype` column by the `CELGenUserEvent` dialplan application. The `cel_pgsql` or `cel_tds` backend must be loaded and configured, and the administrator must call `CELGenUserEvent` in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57186 · Other software · asterisk · reported by GitHubHigh 7.5
Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an `OOH323 request` can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57200 · Other software · asterisk · reported by GitHubHigh 7.5
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, under certain conditions, execute write operations through `REST-over-WebSocket`. The authorization bypass permits `arbitrary module path` loading and conditional remote code execution. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57195 · Other software · asterisk · reported by GitHubHigh 7.5
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the `Asterisk Manager Interface (AMI)` may allow an unauthenticated attacker to crash Asterisk when `Digest Authentication` is used via `HTTP`. The Asterisk `HTTP` web server, AMI, and AMI access via `HTTP` must all be enabled; each is disabled by default. The attacker must be able to connect to the `HTTP` server, which binds only to `127.0.0.1` by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.CVE-2026-116692 · Other software · mlflow · reported by GitHubCritical 9.8
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES rather than requiring an exact allowed module. A caller can use MLflow artifact endpoints to place a Python module beneath a writable allowed package and submit its module and class through /ajax-api/3.0/mlflow/scorer/invoke. Scorer.model_validate_json() imports the module and constructs the class before trace processing. Authentication-disabled deployments permit this code execution without credentials, while basic-auth deployments require a principal capable of creating an experiment and run and uploading artifacts. In either configuration, the allowed scorer package must be writable by the server process. This issue is fixed in version 3.17.0.
- Product
- mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.CVE-2026-116691 · Other software · mlflow · reported by GitHubMedium 6.5
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. mlflow/crewai/autolog.py::_get_agent_attributes() converts the Agent llm field to a string that includes the provider API key, while mlflow/crewai/autolog.py::_construct_full_inputs() expands the Agent object into mlflow.spanInputs. Applications can therefore send plaintext provider credentials to the MLflow trace backend or a configured OTLP destination, where trace readers can obtain them. This issue is fixed in version 3.17.0.
- Product
- mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.CVE-2026-116690 · Other software · mlflow · reported by GitHubHigh 7.5
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when a source has a URL scheme, and mlflow.prompt.is_prompt is interpreted by tag presence rather than a true value. A remote caller can store a server-local path as the model version artifact location and use /api/2.0/mlflow/model-versions/get-artifact to read files accessible to the MLflow server process. Default unauthenticated servers require no privileges, while basic-auth deployments are exposed to authenticated users who can create registered models. This issue is fixed in version 3.17.0.
- Product
- mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect.CVE-2026-118172 · Other software · Strapi · reported by cret@cert.org
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.
- Product
- Strapi Open Source and Enterprise Headless CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint.CVE-2026-118171 · Other software · Strapi · reported by cret@cert.org
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.
- Product
- Strapi Open Source and Enterprise Headless CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possCVE-2026-118170 · Other software · Strapi · reported by cret@cert.org
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
- Product
- Strapi Open Source and Enterprise Headless CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57202 · Other software · asterisk · reported by GitHubHigh 8.1
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57188 · Other software · asterisk · reported by GitHubHigh 7.1
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in `res_xmpp` `XMPP namespace prefix` handling using carefully crafted packets. The `res_xmpp` module must be loaded, an XMPP connection must be configured in `xmpp.conf`, and the attacker must have an XMPP account on the same or a federated server. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57201 · Other software · asterisk · reported by GitHubHigh 7.5
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 `ooTrace()` trace-logging function can occur when unbounded `vsprintf` writes into a fixed `2048-byte buffer`. A remote attacker may send a carefully crafted packet that causes the Asterisk process to crash. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57198 · Other software · asterisk · reported by GitHubLow 2.3
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57197 · Other software · asterisk · reported by GitHubHigh 7.7
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `memcpy` of `OGG/Speex` packet data in `format_ogg_speex` can cause a heap buffer overflow and crash Asterisk when reading a file containing corrupted Speex audio. The attacker must create the file and make it available to Asterisk either through sufficiently elevated privileges or by convincing an Asterisk administrator to make it available. Asterisk must also be configured to play that file. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57194 · Other software · asterisk · reported by GitHubMedium 5.9
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an out-of-bounds write in `chan_unistim` `DIALPAGE` digit handling can overflow the `phone_number` field and crash Asterisk when an attacker sends a carefully crafted incoming request packet. The `chan_unistim` module must be loaded and configured with a valid `UNISTIM UDP port` that the attacker can reach. The attacker must register as a configured `phone MAC`, or the deployment must have an equivalent `production/autoprovisioning` path that allows the client to reach the main page. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57189 · Other software · asterisk · reported by GitHubLow 2.3
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during `generation accumulation` using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57185 · Other software · asterisk · reported by GitHubMedium 6.5
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the `PJSIP MWI body parser` by sending a carefully crafted `SIP NOTIFY` request. The attacker must pass SIP authentication using either a username/password or `source IP address matching`. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026TinyMCE is an open source rich text editor.CVE-2026-116675 · Other software · tinymce · reported by GitHubHigh 8.5
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.
- Product
- tinymce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57196 · Other software · asterisk · reported by GitHubLow 2.3
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in `phone provisioning HTTP error pages` to retrieve an authorized user's `AMI session cookie` and impersonate that user when `res_phoneprov` is enabled. The Asterisk HTTP web server, Asterisk Manager Interface (AMI), and AMI access via HTTP must all be enabled; each is disabled by default. The attacker must be able to connect to the HTTP server, which binds only to `127.0.0.1` by default even when enabled, and must convince the authorized user to click a malicious link. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57193 · Other software · asterisk · reported by GitHubMedium 6.9
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57187 · Other software · asterisk · reported by GitHubHigh 7.1
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJSIP TCP/SDP` handling by sending a `SIP INVITE` over a connection-oriented transport and disconnecting before Asterisk responds with the `200 OK`. So far, the crash has only been reproduced when Asterisk is built with `Address Sanitizer`, which detects the issue. `Address Sanitizer` is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57184 · Other software · asterisk · reported by GitHubMedium 6.3
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser` permits an `out-of-bounds read` that may allow an unauthenticated attacker to crash Asterisk using carefully crafted `setup packets`. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.CVE-2026-115886 · Other software · mlflow · reported by GitHubMedium 6.5
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or its constructor arguments. When optional trulens and trulens-providers-litellm packages are installed, an attacker can select mlflow.genai.scorers.trulens, choose a model URI outside MLflow's native provider registry so execution uses the LiteLLM fallback, and supply api_base and api_key values that cause the server to send an outbound request to an attacker-chosen or internal host with attacker-controlled headers and body. The vulnerable deserialization occurs before a tracking-store lookup or job submission. This issue is fixed in version 3.17.0.
- Product
- mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Cacti is an open source performance and fault management framework.CVE-2026-49442 · Other software · Cacti · reported by GitHubMedium 5.3
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on whether the provided username exists in the system. When username exists on Cacti, in the response, they see Access Denied! Login failed. When it does not exist on Cacti, they see Access Denied! Login Failed. The only difference between the responses is the capitalization of the letter "f" in the word failed. This issue has been patched in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Cacti is an open source performance and fault management framework.CVE-2026-46531 · Other software · Cacti · reported by GitHubMedium 5.5
Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column. The fragment is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/api_automation.php :: create_all_header_nodes() and executed when an administrator triggers automation via the standard graphs.php?action=actions&drp_action=8 ("Apply Automation Rules") bulk action. The result of the injected SELECT is written into graph_tree_items.title and rendered in the Cacti tree UI, providing a direct exfiltration channe. This issue has been patched in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Cacti is an open source performance and fault management framework.CVE-2026-39902 · Other software · Cacti · reported by GitHubHigh 7.2
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Part-DB is an open source inventory management system for electronic components.CVE-2026-86055 · Other software · Part-DB · reported by GitHubHigh 8.7
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.
- Product
- Part-DB-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Part-DB is an open source inventory management system for electronic components.CVE-2026-86020 · Other software · Part-DB · reported by GitHubMedium 4.6
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.
- Product
- Part-DB-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Part-DB is an open source inventory management system for electronic components.CVE-2026-86019 · Other software · Part-DB · reported by GitHubMedium 5.3
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces the configured attachment size limit for normal browser-based file uploads, but the API base64 upload path does not apply the same size validation. As a result, an authenticated user with API access and permission to create attachments can upload files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.
- Product
- Part-DB-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Part-DB is an open source inventory management system for electronic components.CVE-2026-86018 · Other software · Part-DB · reported by GitHubMedium 5.3
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.
- Product
- Part-DB-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Part-DB is an open source inventory management system for electronic components.CVE-2026-59188 · Other software · Part-DB · reported by GitHubMedium 5.4
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin. This issue has been patched in version 2.12.3.
- Product
- Part-DB-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Part-DB is an open source inventory management system for electronic components.CVE-2026-55600 · Other software · Part-DB · reported by GitHubMedium 5.7
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a Part name can store HTML markup in the Part name. When another user imports a BOM CSV referencing that Part ID, the malicious Part name is rendered as HTML in the victim's BOM validation result page. This results in a cross-user stored HTML injection issue. JavaScript execution appears to be blocked by the current Content Security Policy, but arbitrary HTML links, forms, images, and CSS-based UI elements can still be injected into a trusted Part-DB page. This issue has been patched in version 2.12.2.
- Product
- Part-DB-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Part-DB is an open source inventory management system for electronic components.CVE-2026-54631 · Other software · Part-DB · reported by GitHubMedium 6.3
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The official Docker image jbtronics/part-db1 does not override or randomize this value at container start-up. Because Symfony uses APP_SECRET (via kernel.secret) as the HMAC key for signing remember-me cookies, any attacker who knows the secret -- or fetches it from the public repository -- can forge an arbitrary-user remember-me cookie and gain a fully authenticated session with no credentials required. This issue has been patched in version 2.12.1.
- Product
- Part-DB-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Part-DB is an open source inventory management system for electronic components.CVE-2026-54630 · Other software · Part-DB · reported by GitHubCritical 9.6
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image
- Product
- Part-DB-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Part-DB is an open source inventory management system for electronic components.CVE-2026-54615 · Other software · Part-DB · reported by GitHubMedium 6
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns — except the CollectionElementDeleted branch, which interpolates getOldName() (and getCollectionName()) into a sprintf() template with no escaping. The returned string is emitted by LogEntryExtraColumn::render() and inserted as raw HTML into the DataTables cell (the bundle does not escape column output; sibling columns call htmlspecialchars() themselves). CollectionElementDeleted.getOldName() is the name of a deleted collection sub-element — a part Parameter, Attachment, PartLot, Orderdetail, etc. — all freely set by any user with edit rights on the owning element. A low-privileged content editor can therefore store an HTML/script payload as the name of such a sub-element, delete it (which writes the log entry), and have that markup parsed as live DOM in the browser of a higher-privileged vi
- Product
- Part-DB-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026CloudPirates Open Source Helm Charts is a collection of Helm charts.CVE-2026-54532 · Other software · CloudPirates-io · reported by GitHubMedium 6.9
CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workflow is vulnerable to cache poisoning and OIDC token theft. A pull_request_target workflow checks out fork code using github.event.pull_request.head.sha or .head.ref. This gives attacker-controlled code access to base repository secrets and tokens. A pull_request_target workflow writes to a shared Actions cache. A subsequent release or publish workflow restores from the same cache scope, allowing a poisoned cache entry to execute during release. This issue has been patched via commit 271d415.
- Product
- helm-charts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.