Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,621 results · page 1 of 393
Oct 29, 2026HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticCVE-2026-13303 · Other software · HashiCorp · reported by security@hashicorp.comHigh 8.7
HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.
- Product
- Boundary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via suCVE-2026-107046 · Other software · reported by MITRE
A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabCVE-2026-119122 · Other software · unclecode · reported by VulnCheckMedium 6.9
Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to internal and cloud-metadata addresses for port and service discovery.
- Product
- crawl4ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 29, 2026Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to cCVE-2026-119120 · Other software · unclecode · reported by VulnCheckHigh 7.7
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.
- Product
- crawl4ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 29, 2026P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests.CVE-2026-115795 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeMedium 5.3
P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the block length of the following block is read past the end of the buffer. In addition, a DCP Set block with a length smaller than the two-byte block qualifier makes the length underflow, so the block is processed with a length of 65534 bytes. This can cause a crash (denial of service) or disclose a small amount of memory content. Requires ADJACENT network access.
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout foCVE-2026-115793 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeHigh 8.7
P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout for it. Repeated requests with different activity UUIDs exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Endpoint Mapper Lookup and Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service.
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has inCVE-2026-112200 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeHigh 8.7
P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has incorrect endianness. The session and its AR remain allocated, so repeated requests exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service.
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when handling an implicit read request without a valid target AR UUID for a user specCVE-2026-111736 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeHigh 8.7
P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when handling an implicit read request without a valid target AR UUID for a user specific record index, if the application has registered a read callback. A remote unauthenticated attacker can send such a request to crash the device (denial of service).
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR (CVE-2026-111733 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeHigh 8.7
P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR (AR specific indices 0xE000-0xEFFF, and the expected identification data of a slot or subslot). A remote unauthenticated attacker can send such a request to crash the device (denial of service).
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of theCVE-2026-111732 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeCritical 9.3
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block length. A crafted Connect request causes an out-of-bounds write. This can lead to a crash (denial of service) or potentially arbitrary code execution. This option is disabled by default.
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module).CVE-2026-111731 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeHigh 8.7
P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The loop over the ports never advanced to the next port, so the request never completes and the device stops responding. A remote unauthenticated attacker can use this to cause a denial of service.
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF).CVE-2026-104331 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP requCVE-2026-104316 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request, resulting in loss of in-progress compute work with no flow-level permission check.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF).CVE-2026-104315 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vuCVE-2026-104310 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerabiCVE-2026-102590 · Other software · IBM · reported by psirt@us.ibm.comMedium 5
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026WPFunnels: Cross-Site Request Forgery (CSRF)CVE-2026-27062 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5.
- Product
- WPFunnels
- Affected
- up to 3.13.5
- What to do
- Affects up to 3.13.5. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026InstaWP Connect: Cross-Site Request Forgery (CSRF)CVE-2026-116399 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a through 0.1.4.2.
- Product
- InstaWP Connect
- Affected
- up to 0.1.4.2
- What to do
- Affects up to 0.1.4.2. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authentCVE-2026-113688 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 5.3
Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.
- Product
- BMC IT Service Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.helixops.aidocs.helixops.ai
Oct 29, 2026Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link oCVE-2026-5702 · Other software · SABBATIC · reported by cve-coordination@incibe.esMedium 4.8
Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint.
- Product
- SABBATIC app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component.CVE-2026-71569 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.8
Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from 4.21.0 before 4.22.2. WebhookUrlValidator classified a push notification webhook host in two places that did not agree. A host written as an IP literal was matched against a list of string prefixes that named the IPv6 unique local range fc00::/7, while a host reached through a name was resolved and the resulting address classified with the InetAddress predicates isLoopbackAddress, isAnyLocalAddress, isLinkLocalAddress and isSiteLocalAddress. Those predicates do not cover the same ground as the prefix list: isSiteLocalAddress reports the deprecated fec0::/10 block and not the fc00::/7 unique local addresses that replaced it, and the JDK carries no predicate for them at all. The same address was therefore accepted or rejected depending on how it was written, and a webhook URL whose host name resolved into fc00::/7 passed a guard that refused the identical address given as a literal. PushNotificationDispatcher then sent the push notification to that address, together with any Authorization header carried in the same configuration, whose scheme and credentials the
- Product
- Apache Camel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcamel.apache.orggithub.com
Oct 29, 2026download_remote_file that: WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgeryCVE-2026-118989 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.
- Product
- download_remote_file that
- Fixed in
- 2.6.8
- What to do
- Update download_remote_file that to 2.6.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2026A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service.CVE-2026-111418 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.5
A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources.
- Product
- foxit.com
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component.CVE-2026-117859 · Other software · Red Hat · reported by Red HatMedium 5.4
A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an attacker to reuse the same authorization request to obtain multiple access tokens, bypassing security requirements for single-use requests.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 29, 2026Link Library: Does not verify that a requested link belongs to the settings set whose display template is used to render itCVE-2026-78396 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set is configured not to display.
- Product
- Link Library
- Fixed in
- 7.10.0
- What to do
- Update Link Library to 7.10.0 or newer.
Oct 29, 2026Link Library: Does not re-check the selected library's own login requirementCVE-2026-78395 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.
- Product
- Link Library
- Fixed in
- 7.10.0
- What to do
- Update Link Library to 7.10.0 or newer.
Oct 29, 2026Contact Form by Supsystic: Does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statisticsCVE-2026-115300 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.
- Product
- Contact Form by Supsystic
- Fixed in
- 1.11.1
- What to do
- Update Contact Form by Supsystic to 1.11.1 or newer.
Oct 29, 2026WP Photo Album Plus: Does not verify the origin or a security token for one of its comment-management requestsCVE-2026-110983 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
- Product
- WP Photo Album Plus
- Fixed in
- 9.3.04.004
- What to do
- Update WP Photo Album Plus to 9.3.04.004 or newer.
Oct 28, 2026The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML.CVE-2026-113387 · WordPress plugins & themes · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6High 8.6
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.
- Product
- Ortto
- Fixed in
- 1.0.25
- What to do
- Update Ortto to 1.0.25 or newer.
Oct 28, 2026OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+.CVE-2026-118669 · Other software · oauthlib · reported by GitHubHigh 8.4
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented client_id argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0.
- Product
- oauthlib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution CVE-2026-78674 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8High 8.8
The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account.
- Product
- Enterprise Integrator (BPS profile)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Oct 28, 2026The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding.CVE-2026-11854 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 6.1
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information. However, due to the httpOnly flag on session-related cookies, session hijacking or similar attacks are not possible.
- Product
- WSO2 API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Oct 28, 2026n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers CVE-2026-118679 · Other software · n8n-io · reported by VulnCheckMedium 6.9
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 28, 2026n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requesCVE-2026-118647 · Other software · n8n-io · reported by VulnCheckMedium 5.3
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 28, 2026HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.CVE-2026-117501 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer. A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 28, 2026HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk.CVE-2026-116531 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add() treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still holds the chunk-size line. When a read ends in the last bytes of a chunk, add() takes the chunk short and parses the leftover data as the next chunk-size line. A remote attacker can make a chunked body never complete, hanging a server that reads until the body is done, and may make it complete early, leaving the remaining bytes to be read as the next request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 28, 2026HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.CVE-2026-116285 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add() matches each chunk-size line with `/^([\da-fA-F]+).*\x0D\x0A/`. On a line of hex digits whose first LF has no CR before it, the digits and `.*` backtrack against each other, so a single add() takes time quadratic in the line's length. Nothing limits how long the line can be. A remote attacker can exhaust CPU in applications that pass chunked request bodies to HTTP::Body.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 28, 2026A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.1CVE-2026-93523 · Other software · x.org · reported by meissner@suse.deHigh 7.8
A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
- Product
- xorg-x11-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.freedesktop.org
Oct 28, 2026A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data souCVE-2026-88967 · Other software · Grafana · reported by security@grafana.comHigh 7.7
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
- Product
- Grafana Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remeCVE-2026-117619 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.com
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked or expires.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization).CVE-2026-103506 · Other software · Grafana · reported by security@grafana.comHigh 8.9
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
- Product
- Grafana Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients CVE-2026-93521 · Other software · x.org · reported by meissner@suse.deHigh 7.8
A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.
- Product
- xorg-x11-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.freedesktop.org
Oct 28, 2026A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that coulCVE-2026-93517 · Other software · x.orgg · reported by meissner@suse.deHigh 8.5
A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.
- Product
- xorg-x11-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.freedesktop.org
Oct 28, 2026Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attackerCVE-2026-116078 · Other software · mtrudel · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.7
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers. This issue affects bandit: from 0.3.1 before 1.14.1.
- Product
- bandit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 28, 2026HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests CVE-2026-67077 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.2
HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or unauthorized actions through the affected application.
- Product
- BigFix AEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 28, 2026In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sev_gmem_post_populate() set_page_dirty() requires that theCVE-2026-99177 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sev_gmem_post_populate() set_page_dirty() requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from get_user_pages_fast(), so use set_page_dirty_lock(). [sean: tag for stable]
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 28, 2026In the Linux kernel, the following vulnerability has been resolved: page_pool: keep frag_offset aligned for odd-sized requests page_pool_alloc_frag_netmem() rCVE-2026-99127 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: page_pool: keep frag_offset aligned for odd-sized requests page_pool_alloc_frag_netmem() rounds the requested fragment size with size = ALIGN(size, dma_get_cache_alignment()); dma_get_cache_alignment() returns 1 unless the architecture defines ARCH_DMA_MINALIGN, which DMA-coherent architectures such as x86 do not. There the ALIGN() is a no-op and pool->frag_offset advances by the raw, unrounded size. A single caller asking for an odd size then leaves frag_offset misaligned for every fragment carved out of that page afterwards. The pool is shared, so the damage is not confined to the caller that caused it. The per-cpu system_page_pool used by generic XDP hits this. skb_pp_cow_data() allocates its fragments with the raw packet length: size = min_t(u32, len, PAGE_SIZE); truesize = size; page = page_pool_dev_alloc(pool, &page_off, &truesize); leaving frag_offset odd for whatever is carved out of that page next. Its own head allocation is already aligned -- SKB_HEAD_ALIGN(size) plus the XDP_PACKET_HEADROOM its callers pass -- so it is a later user of the shared pool that pays: page_pool_dev_alloc_va() retu
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 28, 2026In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit the request buffer CIFSSMBSetEA() copieCVE-2026-99109 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit the request buffer CIFSSMBSetEA() copies the caller's extended attribute value into the SMB request buffer without checking that it fits. The requirement is stated in the source but was never implemented: /*BB add length check to see if it would fit in negotiated SMB buffer size BB */ /* if (ea_value_len > buffer_size - 512 (enough for header)) */ if (ea_value_len) memcpy(parm_data->list.name + name_len + 1, ea_value, ea_value_len); The only bound applied on the way in is in cifs_xattr_set(): #define MAX_EA_VALUE_SIZE CIFSMaxBufSize ... if (size > MAX_EA_VALUE_SIZE) CIFSMaxBufSize is the full payload capacity of the buffer, so a value of exactly that size leaves no room for the SMB header, the TRANS2 parameter block, the fealist header and the EA name that are written ahead of it in the same object. SendReceive() already enforces the correct limit on this very length: if (in_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) but it is called after the copy has taken place. An unprivileged setxattr(2) on an SMB1 mount with a 250-byte name a
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 28, 2026Essential Addons for Elementor: Does not apply its administrator approval requirement to accounts registered through its email one-time-password flowCVE-2026-110508 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.
- Product
- Essential Addons for Elementor
- Fixed in
- 6.8.7
- What to do
- Update Essential Addons for Elementor to 6.8.7 or newer.
Oct 28, 2026When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` reqCVE-2026-101274 · Other software · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Medium 6.9
When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the SSO client. This means that if an SSO client was configured to only allow the `code` response type, which requires knowledge of the client secret to use and would wrongfully send a response type like `id_token`, it would receive back a valid token. Exploiting this requires the attacker to run JavaScript on the page specified by `redirect_uri`, which must be from a list specified in the client configuration.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.