Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,318 results · page 10 of 347
Oct 13, 2026Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.CVE-2026-102870 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
- Product
- .NET 10.0 installed on Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-102863 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-102860 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.CVE-2026-102202 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.CVE-2026-52394 · Other software · reported by MITRECritical 9.1
DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeepseek.comgist.github.com
Oct 13, 2026fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets aCVE-2026-110129 · Other software · fushengqian · reported by VulnCheckHigh 7.1
fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details.
- Product
- fuintCatering
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify CVE-2026-110127 · Other software · wayn111 · reported by VulnCheckMedium 5.3
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items.
- Product
- waynboot-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or deletCVE-2026-110126 · Other software · wayn111 · reported by VulnCheckMedium 5.3
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POST /address or DELETE /address/{addressId} requests to overwrite or remove victims' saved addresses.
- Product
- waynboot-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and mCVE-2026-110124 · Other software · kerwincui · reported by VulnCheckHigh 8.6
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite user_id and tenant_id to take over devices.
- Product
- FastBee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify CVE-2026-110117 · Other software · 1024-lab · reported by VulnCheckHigh 7.1
SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpoints to disable login lockout and two-factor login, weaken password rules, and clear lockout records.
- Product
- SmartAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler thatCVE-2026-110115 · Other software · risesoft-y9 · reported by VulnCheckHigh 8.7
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials.
- Product
- Digital-Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows autCVE-2026-110113 · Other software · Sanluan · reported by VulnCheckMedium 5.3
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing anyCVE-2026-110099 · Other software · Jorani · reported by VulnCheckMedium 5.3
Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees or hr/exportLeaves/{id} and hr/exportOvertime/{id} to download employee names, emails, contracts, managers, and any employee's leave and overtime records.
- Product
- Jorani
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-CVE-2026-106042 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Critical 9.9
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.
- Product
- Xtraction
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.CVE-2024-34320 · Other software · reported by MITRECritical 9.8
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprophoenix.comsedriclouissaint.com
Oct 13, 2026Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust CVE-2026-74030 · Other software · Wazuh · reported by VulnCheckMedium 6.9
Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy with nested aliases via merged.mg to OOM-kill wazuh-modulesd on every agent in a group.
- Product
- wazuh-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level secuCVE-2026-109959 · Other software · espocrm · reported by VulnCheckMedium 5.3
EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/{id}, which skips the NoteAccessControl filter, and recover data.attributes.was and became values of restricted fields.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the addCVE-2026-109958 · Other software · espocrm · reported by VulnCheckMedium 5.3
EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the emailAddress field.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via overCVE-2026-109947 · Other software · FreeRDP · reported by VulnCheckHigh 7.1
FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRP_MJ_READ with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an under-reserved buffer on 32-bit builds.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts aCVE-2026-109942 · Other software · FreeRDP · reported by VulnCheckHigh 7.1
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-byte CLOSE_CHANNEL header to crash a connecting FreeRDP client.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read.CVE-2026-65150 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.3
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability mighty lead to information disclosure, data tampering, and denial of service.
- Product
- DALI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Oct 13, 2026NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write.CVE-2026-65149 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.3
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.
- Product
- DALI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Oct 13, 2026NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read.CVE-2026-65147 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.3
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure and denial of service.
- Product
- DALI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Oct 13, 2026Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page.CVE-2026-63357 · Other software · Siemens · reported by productcert@siemens.comMedium 5.3
Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
- Product
- SIMATIC Drive Controller CPU 1504D TF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Oct 13, 2026Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace pagCVE-2026-63356 · Other software · Siemens · reported by productcert@siemens.comMedium 5.3
Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the resulting error message is displayed.
- Product
- SIMATIC Drive Controller CPU 1504D TF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Oct 13, 2026Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page.CVE-2026-63355 · Other software · Siemens · reported by productcert@siemens.comMedium 5.3
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the user subsequently interacts with an affected selection menu.
- Product
- SIMATIC Drive Controller CPU 1504D TF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Oct 13, 2026Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.CVE-2026-63354 · Other software · Siemens · reported by productcert@siemens.comCritical 9.4
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
- Product
- SIMATIC Drive Controller CPU 1504D TF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Oct 13, 2026Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page.CVE-2026-63353 · Other software · Siemens · reported by productcert@siemens.comCritical 9.4
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
- Product
- SIMATIC Drive Controller CPU 1504D TF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Oct 13, 2026Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page.CVE-2026-63352 · Other software · Siemens · reported by productcert@siemens.comMedium 5.3
Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
- Product
- SIMATIC Drive Controller CPU 1504D TF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Oct 13, 2026Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on thCVE-2026-63351 · Other software · Siemens · reported by productcert@siemens.comMedium 5.3
Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
- Product
- SIMATIC Drive Controller CPU 1504D TF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Oct 13, 2026Affected devices do not properly restrict executable content contained in imported trace files.CVE-2026-63350 · Other software · Siemens · reported by productcert@siemens.comCritical 9.4
Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
- Product
- SIMATIC Drive Controller CPU 1504D TF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Oct 13, 2026Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in FirCVE-2026-103418 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 12, 2026IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.CVE-2026-17484 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.CVE-2026-75095 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
- Product
- Aspera Enterprise WebApps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that CVE-2026-109675 · Other software · frappe · reported by VulnCheckMedium 5.3
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names, message counts, automation rules with sender addresses, and storage quota usage.
- Product
- suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not vaCVE-2026-109652 · Other software · frappe · reported by VulnCheckHigh 8.7
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.
- Product
- erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-CVE-2023-54412 · Other software · frappe · reported by VulnCheckHigh 7.1
Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.CVE-2026-92876 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
- Product
- Maximo Application Suite - IoT Component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.CVE-2026-90920 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
- Product
- Maximo AI Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.CVE-2026-90912 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
- Product
- Maximo AI Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.CVE-2026-90911 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
- Product
- Maximo AI Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom ResourCVE-2026-18513 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
- Product
- Maximo Application Suite - Location Service for Esri Component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks.CVE-2026-109568 · Other software · MarceauKa · reported by VulnCheckHigh 7.1
Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/{link,story,chest,album}/{id} with numeric IDs to overwrite or delete other users' content, including private items.
- Product
- Shaark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, tCVE-2026-109448 · Other software · PostgreSQL · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 5.9
Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps that count to -32768. Binding parameter 32769 then writes about 2.5 MB of zeros starting 1.25 MB before the binding array, which crashes the application or leaves it running on a corrupted heap. Applications that build parameter lists from untrusted input, such as an IN (?, ?, ...) list, are exposed. Versions before psqlODBC 18.00.0005 are affected.
- Product
- psqlODBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Salevo: External Control of Assumed-Immutable Web ParameterCVE-2026-103080 · WordPress plugins & themes · reported by PatchstackMedium 5.3
External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0.
- Product
- Salevo
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Salevo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forCVE-2026-109365 · Other software · ZcashFoundation · reported by VulnCheckMedium 6.3
Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling, Orchard, and Ironwood proof verification without penalty and stalling sync for 67 seconds.
- Product
- zebra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scopCVE-2026-109362 · Other software · heymrun · reported by VulnCheckMedium 5.3
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.
- Product
- heym
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports withoutCVE-2026-109356 · Other software · librenms · reported by VulnCheckMedium 5.3
LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase every deleted port on all visible devices.
- Product
- librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pCVE-2026-109351 · Other software · GitoxideLabs · reported by VulnCheckHigh 7.1
Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.
- Product
- gix-pack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only CVE-2026-109331 · Other software · Jovancoding · reported by VulnCheckHigh 7.5
Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP script parameter beside a benign file_path or command, evading denyPatterns to write web shells or execute scripts.
- Product
- Network-AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.