Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23,279 results · page 1 of 466
Oct 30, 2026Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest apCVE-2026-59388 · Other software · Cloud Foundry Foundation · reported by security@vmware.comMedium 6.5
Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.
- Product
- CAPI (Cloud Foundry Controller)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rulCVE-2026-59387 · Other software · Cloud Foundry · reported by security@vmware.comHigh 8.8
The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS. An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.
- Product
- CAPI (Cloud Controller API)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges.CVE-2026-59386 · Other software · Cloud Foundry · reported by security@vmware.comMedium 6.5
A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.
- Product
- Cloud Foundry Controller (CAPI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More: Arbitrary Plugin InstallationCVE-2026-89435 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server. Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed).
- Product
- Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More
- Affected
- up to 6.35
- What to do
- Affects up to 6.35. Update Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026A flaw was found in Red Hat Enterprise Linux 9 kernel builds.CVE-2026-118593 · Other software · Red Hat · reported by Red HatMedium 5.9
A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. This can lead to softirq starvation and denial of service on systems with SRv6 tunnels configured. Upstream and RHEL 10 are not affected.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 30, 2026Cool FormKit Lite – Advanced Form Builder for Elementor: Stored DOM-Based Cross-Site ScriptingCVE-2026-118500 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The esc_html() call applied at server emission is bypassed because the HTML fragment-serialization algorithm restores " to a raw double-quote inside text nodes when jQuery .html() extracts the template, allowing the attacker-controlled custom_id to break out of an HTML attribute context within the plugin's own frontend script.
- Product
- Cool FormKit Lite – Advanced Form Builder for Elementor
- Affected
- up to 2.7.9
- What to do
- Affects up to 2.7.9. Update Cool FormKit Lite – Advanced Form Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).CVE-2026-114532 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.
- Product
- UI Icons
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).CVE-2026-114527 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.
- Product
- UI Icons
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests.CVE-2026-91920 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.
- Product
- Red Hat build of Apache Camel for Spring Boot 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 29, 2026A flaw was found in the required action provider mechanism of Keycloak.CVE-2026-118959 · Other software · Red Hat · reported by Red HatMedium 5.4
A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 29, 2026A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and idCVE-2026-118947 · Other software · Red Hat · reported by Red HatMedium 4.3
A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 29, 2026A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate prCVE-2026-119251 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Medium 6.7
A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host device.
- Product
- WiFiman Desktop for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS tCVE-2026-119250 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984High 7.8
A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device.
- Product
- WiFiman Desktop for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop for macOS to obtain inCVE-2026-119249 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984High 7.5
A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop for macOS to obtain information about the host device.
- Product
- WiFiman Desktop for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.CVE-2026-118761 · Other software · kubeflow · reported by GitHubHigh 7.5
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.
- Product
- pipelines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.CVE-2026-118760 · Other software · kubeflow · reported by GitHubMedium 6.5
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who can reach the frontend and knows an artifact location can select another tenant's namespace, or omit the namespace and reach an unguarded direct handler, to read artifact contents such as datasets, models, or pipeline outputs. The issue applies to multi-user deployments that rely on Kubeflow Pipelines authorization for tenant isolation. Authentication at ingress identifies the caller but does not authorize access to the selected artifact namespace. The issue does not establish arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution. This issue is fixed in version 2.17.0.
- Product
- pipelines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.CVE-2026-118759 · Other software · kubeflow · reported by GitHubHigh 7.5
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and suitable pod or node identifier can read live or archived logs with the API server's permissions. For live logs, the caller-controlled node ID was also accepted as a pod name without verifying that the pod belonged to the requested run, allowing a known run ID to select the namespace of an unrelated pod and read its main container logs. The handler does not authenticate requests itself, although an external authentication gate or network policy can limit reachability. Exposed logs can contain sensitive workload data or credentials. This issue is fixed in version 2.18.0.
- Product
- pipelines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.CVE-2026-118758 · Other software · kubeflow · reported by GitHubHigh 7.5
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify an existing mounted volume can use path traversal to read files outside that volume when the artifact-serving process can read them. The frontend pod serves the request when artifact proxying is disabled, while the selected namespace's artifact-service pod serves it when proxying is enabled. A deployment with authentication disabled requires no application credentials; in multi-user deployments, the caller ordinarily must be authorized for the supplied namespace. This issue is fixed in version 2.18.0.
- Product
- pipelines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM CVE-2026-107051 · Other software · reported by MITRE
Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code executCVE-2026-107050 · Other software · reported by MITRE
An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted CVE-2026-107048 · Other software · reported by MITRE
An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI.CVE-2026-66912 · Email & office · Synacor · reported by cvd@cert.plMedium 5.3
Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript payload. When the victim opens the message in Classic UI and clicks Reply while composing in HTML mode with reply headers disabled, the unsanitized From header content is rendered as HTML and the JavaScript payload executes in the victim's browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim. This issue was fixed in version 10.1.21
- Product
- Zimbra Collaboration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plwiki.zimbra.com
Oct 29, 2026Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.CVE-2026-54857 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
- Affected
- up to 1.23
- What to do
- Affects up to 1.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.CVE-2026-20942 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credentialCVE-2026-119128 · Other software · zitadel · reported by VulnCheckCritical 9.1
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 29, 2026ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, inCVE-2026-119127 · Other software · zitadel · reported by VulnCheckHigh 8.6
ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 29, 2026Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a writCVE-2026-119126 · Other software · parse-community · reported by VulnCheckLow 2.3
Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade audit logging, notifications, and derived data updates.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 29, 2026The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-116848 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 6.5.3.
- Product
- The Plus Addons for Elementor Page Builder Lite
- Affected
- up to 6.5.3
- What to do
- Affects up to 6.5.3. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout foCVE-2026-115793 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeHigh 8.7
P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout for it. Repeated requests with different activity UUIDs exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Endpoint Mapper Lookup and Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service.
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when handling an implicit read request without a valid target AR UUID for a user specCVE-2026-111736 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeHigh 8.7
P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when handling an implicit read request without a valid target AR UUID for a user specific record index, if the application has registered a read callback. A remote unauthenticated attacker can send such a request to crash the device (denial of service).
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR (CVE-2026-111733 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeHigh 8.7
P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR (AR specific indices 0xE000-0xEFFF, and the expected identification data of a slot or subslot). A remote unauthenticated attacker can send such a request to crash the device (denial of service).
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of theCVE-2026-111732 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeCritical 9.3
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block length. A crafted Connect request causes an out-of-bounds write. This can lead to a crash (denial of service) or potentially arbitrary code execution. This option is disabled by default.
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.CVE-2026-108494 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026ShopBuilder – Elementor WooCommerce Builder Addons: Missing AuthorizationCVE-2026-54871 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.2.
- Product
- ShopBuilder – Elementor WooCommerce Builder Addons
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update ShopBuilder – Elementor WooCommerce Builder Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Profile Builder: Missing AuthorizationCVE-2026-54853 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5.
- Product
- Profile Builder
- Affected
- up to 4.0.5
- What to do
- Affects up to 4.0.5. Update Profile Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len inCVE-2026-119053 · Other software · lwIP · reported by VulnCheckMedium 6.9
lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.
- Product
- lwIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution.CVE-2026-118425 · Other software · Red Hat · reported by Red HatMedium 6.8
A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated useCVE-2026-113696 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 5.3
Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows aCVE-2026-113695 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 4.8
Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated useCVE-2026-113694 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 5.3
Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenCVE-2026-113693 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 5.3
Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administratCVE-2026-113692 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 6.9
Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticaCVE-2026-113691 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 5.1
Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated useCVE-2026-113690 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 4.8
Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated useCVE-2026-113689 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 5.1
Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authentCVE-2026-113688 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 5.3
Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: Sensitive Information ExposureCVE-2026-91153 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary WordPress post meta values — including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type — via form submission notification emails or stored entries. The submission nonce is publicly rendered in every embedded form and can additionally be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, meaning no account or prior authentication of any kind is required to complete the exploit.
- Product
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 29, 2026Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: Reflected Cross-Site ScriptingCVE-2026-91152 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evf_toast_type' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evf_toast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite.
- Product
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2026HT Mega Addons for Elementor – Elementor Widgets & Template Builder: Stored DOM-Based Cross-Site ScriptingCVE-2026-111318 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of <a> inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a co-installed plugin such as wpDiscuz with its rich editor enabled whose markup allowlist permits span[class] and a[href] storage, an HT Mega Tabs widget present on the same page as the comment section, and a victim user click on the injected anchor link.
- Product
- HT Mega Addons for Elementor – Elementor Widgets & Template Builder
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update HT Mega Addons for Elementor – Elementor Widgets & Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2026Greenshift – animation and page builder blocks: Stored DOM-Based Cross-Site ScriptingCVE-2026-107629 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the affected post page to include an Advanced HTML Element block with Split Text animation enabled wrapping a Latest Comments block that displays comment excerpts, as this configuration causes splittext.js to be enqueued and to process the comment content container.
- Product
- Greenshift – animation and page builder blocks
- Affected
- up to 13.2.1
- What to do
- Affects up to 13.2.1. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.