Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16,404 results · page 1 of 329
Oct 30, 2026Content Egg – Affiliate Product Importer & Price Comparison: Authorization bypassCVE-2026-119087 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to create posts attributed to another user's account — typically an administrator — by supplying an admin-owned preset_id, causing wp_insert_post to record the administrator as post_author. This includes the ability to create published posts when the attacker already holds publish_posts capability for the preset's post type, resulting in administrator-attributed published content created by a lower-privileged user.
- Product
- Content Egg – Affiliate Product Importer & Price Comparison
- Affected
- up to 12.0.0
- What to do
- Affects up to 12.0.0. Update Content Egg – Affiliate Product Importer & Price Comparison to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2026Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and caCVE-2026-65586 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ce
Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages. A memory buffer managed by a CPU thread of control (driver) and accessed by a GPU thread of control (firmware) can be freed while in use. Software installed and run as a non-privileged user may replace that buffer with another and replace a shared resource (memory page address list) managed by the CPU thread of control (driver) leading to the GPU accessing memory not managed by the CPU thread of control (driver).
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel.CVE-2026-65584 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ce
Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded from the stack array. Successful exploitation can cause kernel memory corruption and typically results in a denial-of-service condition through a kernel crash. The code vulnerability is a buffer write beyond the allocated array on the stack caused by copying excessive data from an internal buffer.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory.CVE-2026-19199 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ce
Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer allocation. This may allow unallocated or previously allocated physical pages to be mapped into an attacker-controlled GPU MMU context, leading to disclosure of sensitive kernel data.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destCVE-2026-15466 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ce
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decremented in non-atomical way allowing other code paths using a freed object to read and/or write kernel heap memory.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.CVE-2026-118078 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outsiCVE-2026-104312 · Other software · IBM · reported by psirt@us.ibm.comLow 3.5
IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim using a non-sanitizing tool could result in arbitrary file write on the victim's host.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Product Feed Manager: Missing AuthorizationCVE-2026-118093 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1.
- Product
- Product Feed Manager
- Affected
- up to 7.14.1
- What to do
- Affects up to 7.14.1. Update Product Feed Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026download_remote_file that: WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgeryCVE-2026-118989 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.
- Product
- download_remote_file that
- Fixed in
- 2.6.8
- What to do
- Update download_remote_file that to 2.6.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2026Automated Import Products to Cart: Does not sanitize a user-supplied file path before using it to read and delete filesCVE-2026-113617 · WordPress plugins & themes · reported by WPScanCritical 9.9
The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.
- Product
- Automated Import Products to Cart
- Fixed in
- 1.0.4
- What to do
- Update Automated Import Products to Cart to 1.0.4 or newer.
Oct 28, 2026The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages.CVE-2026-114173 · WordPress plugins & themes · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Medium 5.3
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.
- Product
- Ortto
- Fixed in
- 1.0.25
- What to do
- Update Ortto to 1.0.25 or newer.
Oct 28, 2026Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expectedCVE-2025-14260 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8High 8.3
Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.
- Product
- WSO2 API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Oct 28, 2026An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart ConducCVE-2026-103407 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 8.8
An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API.
- Product
- Session Smart Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.net
Oct 28, 2026An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allowCVE-2026-103406 · Network & remote access · Juniper Networks · reported by sirt@juniper.netCritical 9.8
An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.
- Product
- Session Smart Conductor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.net
Oct 28, 2026An Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows a local user to acceCVE-2026-103404 · Network & remote access · Juniper Networks · reported by sirt@juniper.netMedium 6.8
An Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials via triggering processes that write to the /tmp directory.
- Product
- Session Smart Conductor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.net
Oct 28, 2026An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker CVE-2026-103402 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 8.8
An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files.
- Product
- Session Smart Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.net
Oct 28, 2026An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to causeCVE-2026-103390 · Network & remote access · Juniper Networks · reported by sirt@juniper.netMedium 5.3
An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to cause a denial of service via a specially crafted HTTP request.
- Product
- Session Smart Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.net
Oct 28, 2026HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package..CVE-2026-21830 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or non‐AWS endpoints.
- Product
- BigFix AEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 28, 2026eCommerce Product Catalog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115596 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Reflected XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.4.
- Product
- eCommerce Product Catalog
- Affected
- up to 3.6.4
- What to do
- Affects up to 3.6.4. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2026Product Addons for Woocommerce – Product Options with Custom Fields: Stored Cross-Site ScriptingCVE-2026-109988 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Product Addons for Woocommerce – Product Options with Custom Fields
- Affected
- up to 3.1.8
- What to do
- Affects up to 3.1.8. Update Product Addons for Woocommerce – Product Options with Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 28, 2026Product Designer for WooCommerce WordPress | Lumise: Directory TraversalCVE-2026-15323 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process_checkout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The lumise_security nonce required to reach the vulnerable /?lumise=cart endpoint is freely obtainable by any unauthenticated visitor via the /?lumise=ajax action=init handler, making this exploitable with no prior access or credentials.
- Product
- Product Designer for WooCommerce WordPress | Lumise
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Product Designer for WooCommerce WordPress | Lumise to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 28, 2026Welcart e-Commerce: Does not properly verify authorization against the targeted product before processing SKU changesCVE-2026-111032 · WordPress plugins & themes · reported by WPScanLow 3.8
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read, modify, create, delete and re-order the SKU data (including prices, confidential cost prices and stock levels) of any product, including those belonging to other users.
- Product
- Welcart e-Commerce
- Fixed in
- 2.12.6
- What to do
- Update Welcart e-Commerce to 2.12.6 or newer.
Oct 28, 2026affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display: Arbitrary File UploadCVE-2026-111255 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due to a weak Content-Type prefix check and extension derivation from the attacker-controlled URL path, with no dangerous-extension stripping. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the "import product image" option to be enabled in the plugin settings, as this activates the image download pipeline triggered on product post save.
- Product
- affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
- Affected
- up to 3.9.2
- What to do
- Affects up to 3.9.2. Update affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 27, 2026nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssCVE-2026-117605 · Websites & servers · nopSolutions · reported by VulnCheckMedium 5.3
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.
- Product
- nopCommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display: Stored Cross-Site ScriptingCVE-2026-111314 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkp_product_producturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation by unauthenticated attackers requires that the plugin's AJAX loading / AJAX handler option is enabled (atkp_options::get_ajax_loading_enabled() || get_ajax_handler_enabled()) and the attacker knows a product id to render. On a default installation, where that is not configured, the vulnerability requires attackers with contributor-level access and above.
- Product
- affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
- Affected
- up to 3.9.2
- What to do
- Affects up to 3.9.2. Update affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 27, 2026Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine.CVE-2026-58496 · Other software · thorvg · reported by GitHubMedium 4.3
Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an undersized font directly from memory through public APIs such as `tvg::Text::load` causes an out-of-bounds read. Loading through a file path using `mmap` can mask the read because of page alignment; the memory-loading API directly exposes it. Depending on memory layout, a malformed short font may crash the consuming application or disclose adjacent heap memory. This issue is fixed in version 1.0.7.
- Product
- thorvg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026WebSub is a W3C recommendation produced by the Social Web Working Group.CVE-2026-50571 · Other software · w3c · reported by GitHubMedium 5.7
WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo the `hub.challenge` value, also exposed as `hub_challenge` by some frameworks, but does not require safe response media typing or disabled MIME sniffing. An attacker can initiate a subscription to obtain a callback URL and redirect a victim browser to a crafted verification request containing HTML or JavaScript. Subscribers that return the challenge as `text/html` can execute the reflected content in the subscriber origin, using a victim's existing session to read private data or perform actions, exposing `localStorage` or `sessionStorage` and browser permissions granted to that origin. An alternative uses the verification response as an attacker-controlled same-origin script resource to bypass `script-src 'self'`; this can remain possible with `application/octet-stream` when MIME sniffing is allowed. Safe media typing and `X-Content-Type-Options: nosniff` are both needed to address the described scenarios. WebSub Rocks demonstrated reflection, but the advisory does not establish practical impact on that demon
- Product
- websub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote CodCVE-2026-78845 · Other software · reported by MITRE
Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root description parsing.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control CVE-2026-13162 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 7.7
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting the system time-zone. When processing time-zone configuration updates, the daemon constructs a shell command by concatenating user-supplied input without any sanitization or validation.
- Product
- CoreTec 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Oct 27, 2026Out-of-bounds Write Vulnerability in JP1 Products.CVE-2026-86577 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.4
Out-of-bounds Write Vulnerability in JP1 Products. This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: from 13-00 before 13-50-31; JP1/Base: from 11-00 before 12-50-54.
- Product
- JP1/Integrated Management 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Heap-based Buffer Overflow Vulnerability in JP1 Products.CVE-2026-86576 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.4
Heap-based Buffer Overflow Vulnerability in JP1 Products. This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: from 13-00 before 13-50-31; JP1/Base: from 11-00 before 12-50-54.
- Product
- JP1/Integrated Management 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Stack-based Buffer Overflow Vulnerability in JP1 Products.CVE-2026-86575 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.4
Stack-based Buffer Overflow Vulnerability in JP1 Products. This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: from 13-00 before 13-50-31; JP1/Base: from 11-00 before 12-50-54.
- Product
- JP1/Integrated Management 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is reCVE-2026-102788 · Other software · balbooa.com · reported by security@joomla.orgCritical 9.3
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
- Product
- Gridbox extension for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites.CVE-2026-81509 · Other software · nosduco · reported by GitHubMedium 6.1
nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites. Versions prior to 1.5.1 accept an unvalidated `r` query parameter on the `/login` endpoint and use them as the post-authentication redirect destination. An unauthenticated attacker can create a legitimate `nforwardauth` login URL that redirects a victim to an attacker-controlled website after the victim successfully authenticates. This issue may facilitate phishing and other social-engineering attacks by abusing the trust associated with the legitimate authentication domain. This vulnerability does not provide an unauthenticated ForwardAuth bypass. Version 1.5.1 contains a patch.
- Product
- nforwardauth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Bopo – WooCommerce Product Bundle Builder: Missing AuthorizationCVE-2026-110377 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3.
- Product
- Bopo – WooCommerce Product Bundle Builder
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Bopo – WooCommerce Product Bundle Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2026A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress.CVE-2026-116107 · WordPress plugins & themes · reported by VulDBLow 2.1
A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.
- Affected
- up to 1.3.24
- What to do
- Affects up to 1.3.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2026Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).CVE-2026-114820 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.1
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients ru
- Product
- Oracle Java SE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2026Product Filter by WBW: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-112866 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
- Product
- Product Filter by WBW
- Affected
- up to 3.4.6
- What to do
- Affects up to 3.4.6. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 23, 2026A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege CVE-2026-91093 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 8.5
A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.
- Product
- HP One Agent Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite.CVE-2026-54668 · Other software · kitodo · reported by GitHubHigh 8.7
Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The methods parseXMLString(String), getNumberOfEADElements(String, String) and checkIfXmlIsWellFormed(String) build a DocumentBuilderFactory / XMLInputFactory / SAXParserFactory via newInstance() and parse the attacker-supplied string without disabling DOCTYPE declarations or external entity resolution. These helpers sit directly on the EAD-import path: an authenticated user who uploads an EAD/XML file through the "Create process" file-upload dialog has the uploaded bytes parsed by these methods. A crafted document with an external entity therefore yields XML External Entity (XXE) injection: local file disclosure and outbound SSRF requests from the server. This issue has been patched in version 3.9.2.
- Product
- kitodo-production
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying aCVE-2026-99025 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow dump and panicked. ovs_flow_cmd_dump() calls ovs_flow_stats_get() for every flow it emits, and that releases stats->lock with spin_unlock_bh() once per CPU that has touched the flow. Every release is a local_bh_enable(), and each one runs the pending softirq backlog in the dumping thread's own context. The skb bounds the flows one callback emits, but not the softirq work it absorbs. On a CPU that carries the box's packet load the backlog refills as fast as it drains, so the dumping thread becomes that CPU's softirq engine. It never sleeps and it has no reschedule point, so under voluntary preemption nothing can take the CPU away from it: neither the ksoftirqd the kernel woke to take the work over, nor the stopper thread the softlockup detector dispatches to refresh its timestamp. Hold BH off across the whole callback instead, the way ctnetlink_dump_table() does, so the nested spin_unlock_bh() stop draining softirqs. The loop already runs under rcu
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 23, 2026The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file.CVE-2025-30051 · Other software · CGM · reported by cvd@cert.plMedium 6.8
The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account. This issue was fixed in version 2026.MS3
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the servicCVE-2026-112331 · Other software · GDATASoftwareAG · reported by VulnCheckHigh 8.7
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.
- Product
- motornet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack.CVE-2026-79895 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.5
Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack.CVE-2026-79893 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.5
Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgerCVE-2026-79880 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.7
A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance.CVE-2026-79854 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS insCVE-2026-79852 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 insCVE-2026-79849 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 10
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 insCVE-2026-79848 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 10
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.