Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22,723 results · page 10 of 455
Oct 17, 2026phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due CVE-2026-111904 · Other software · thorsten · reported by VulnCheckMedium 6.9
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions endpoint to retrieve non-public moderation or internal questions and their associated usernames.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 17, 2026Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query pCVE-2024-58398 · Other software · coder · reported by VulnCheckMedium 5.3
Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.
- Product
- coder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026OpenHuman is an open-source agent harness available as a desktop application and Rust library.CVE-2026-49410 · Other software · tinyhumansai · reported by GitHubHigh 8.1
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0.
- Product
- openhuman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering.CVE-2026-108372 · Other software · huangruiteng · reported by GitHubHigh 7.1
Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to `GET /status.json`, `GET /review-material?goal_id=...&path=...`, `GET /`, and `POST /control-plane/configure-goal/dry-run`, exposing control-plane state, goal and run information, local absolute paths, private Markdown files below registered goal roots, and dry-run configuration projections. The affected routes do not provide cross-origin writes or arbitrary-file access. This issue is fixed in version 0.4.5.
- Product
- loopx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Frappe HR is an open-source human resources management solution (HRMS).CVE-2026-64862 · Other software · frappe · reported by GitHubMedium 6.5
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records associated with another employee through PWA API endpoints. Successful exploitation can access sensitive HR data belonging to other employees. This issue is fixed in versions 15.58.3 and 16.4.3.
- Product
- hrms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Frappe HR is an open-source human resources management solution (HRMS).CVE-2026-55796 · Other software · frappe · reported by GitHubMedium 6.5
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1.
- Product
- hrms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-108374 · Other software · frappe · reported by GitHubHigh 7.7
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.
- Product
- erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-108373 · Other software · frappe · reported by GitHubMedium 6.5
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user's document permission match conditions. This allows the user to read financial data beyond the user's permitted role. This issue is fixed in versions 15.118.0 and 16.27.0.
- Product
- erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026ZoneMinder is a free, open source closed-circuit television software application.CVE-2026-30971 · Other software · ZoneMinder · reported by GitHubHigh 8.8
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries.CVE-2026-102834 · Other software · bytedeco · reported by GitHubHigh 7.5
JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint or a tampered plaintext stream. The source can return an oversized Content-Length header in an MJPEG stream. Successful exploitation can trap the frame-grabbing thread in a permanent CPU-spinning loop and deny service. This issue is fixed in version 1.5.14.
- Product
- javacv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026ZoneMinder is a free, open source closed-circuit television software application.CVE-2026-102608 · Other software · ZoneMinder · reported by GitHubCritical 9
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026ZoneMinder is a free, open source closed-circuit television software application.CVE-2026-102607 · Other software · ZoneMinder · reported by GitHubHigh 8.8
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted.CVE-2026-111793 · Other software · Openwave Messaging (Ireland) Limited · reported by MITREMedium 4.3
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
- Product
- Webtop Media Transcoder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Integer overflow in OpenModSim (<=1.11.0), leading to denial of serviceCVE-2025-66969 · Other software · reported by MITREHigh 7.5
Integer overflow in OpenModSim (<=1.11.0), leading to denial of service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGaCVE-2026-111721 · Other software · jingsewu · reported by VulnCheckMedium 5.3
Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses.
- Product
- open-wes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers CVE-2026-111696 · Other software · shaiwz · reported by VulnCheckHigh 7.1
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.
- Product
- data-platform-open
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to accesCVE-2026-111695 · Other software · shaiwz · reported by VulnCheckHigh 7.1
Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.
- Product
- data-platform-open
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDCVE-2026-111688 · Other software · Exrick · reported by VulnCheckMedium 5.3
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization's department tree and names outside their assigned scope.
- Product
- xboot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /CVE-2026-111660 · Other software · wayn111 · reported by VulnCheckMedium 6.9
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.
- Product
- waynboot-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens usinCVE-2026-111636 · Other software · OpenBMB · reported by VulnCheckCritical 9.2
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.
- Product
- StaffDeck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes CVE-2026-111622 · Other software · a466350665 · reported by VulnCheckHigh 7.6
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.
- Product
- smart-sso
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying CVE-2026-111613 · Other software · alldatacenter · reported by VulnCheckHigh 8.7
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.
- Product
- alldata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access otherCVE-2026-111609 · Other software · PKP · reported by VulnCheckMedium 5.1
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.
- Product
- Open Journal Systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems.CVE-2026-49868 · Other software · RIOT-OS · reported by GitHubCritical 9.8
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.
- Product
- RIOT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems.CVE-2026-102693 · Other software · RIOT-OS · reported by GitHubCritical 9.6
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.
- Product
- RIOT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems.CVE-2026-102692 · Other software · RIOT-OS · reported by GitHubCritical 9.1
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.
- Product
- RIOT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session.CVE-2026-68908 · Other software · mz-automation · reported by GitHubMedium 5.3
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes sendNextReportEntrySegment to serialize the report, the function wraps rptIdBuf[130] as a temporary MmsValue and passes it to MmsValue_setVisibleString. The setter's resize path frees the stack-backed buffer, allowing a remote client to trigger an invalid free and server crash by writing the oversized RptID and then generating a report. This issue is fixed in version 1.6.2.
- Product
- libiec61850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session.CVE-2026-68907 · Other software · mz-automation · reported by GitHubHigh 8.2
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. The helper treats uninitialized dataSetRef[130] storage as a source string, causing strlen to read beyond the stack buffer, and then copies those bytes into the caller-owned listName buffer. A remote defineNamedVariableList request can crash servers that have dynamic dataset service enabled and a dataset access handler installed; the advisory also observes caller stack corruption but establishes denial of service as the primary impact. This issue is fixed in version 1.6.2.
- Product
- libiec61850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session.CVE-2026-68906 · Other software · mz-automation · reported by GitHubHigh 8.7
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.
- Product
- libiec61850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session.CVE-2026-57446 · Other software · mz-automation · reported by GitHubMedium 5.3
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked MMS_FILE_UPLOAD_STATE_NOT_USED. If a later ObtainFile request reuses that task and destination creation fails, MMS_FILE_UPLOAD_STATE_SEND_OBTAIN_FILE_ERROR_DESTINATION cleanup closes the stale FILE object again. Servers with the MMS file service and ObtainFile enabled can therefore be crashed remotely by the success-then-failure request sequence. This issue is fixed in version 1.6.2.
- Product
- libiec61850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Open Zaak is an open-source data and services layer for Dutch case-oriented working.CVE-2026-55836 · Other software · open-zaak · reported by GitHubMedium 6.8
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains under IMPORT_DOCUMENTEN_BASE_DIR. A client with an all-authorizations application token can supply an absolute or parent-traversal path to a file readable by the Celery service account. The worker copies that file into document storage, allowing its contents to be retrieved through the normal document download API and exposing server secrets or other private files. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
- Product
- open-zaak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026TuxGuitar is an open-source guitar tablature editor.CVE-2026-55543 · Other software · helge17 · reported by GitHubHigh 8.5
TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.
- Product
- tuxguitar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Open Zaak is an open-source data and services layer for Dutch case-oriented working.CVE-2026-54657 · Other software · open-zaak · reported by GitHubMedium 6.5
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
- Product
- open-zaak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session.CVE-2026-48741 · Other software · mz-automation · reported by GitHubHigh 7.5
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.
- Product
- libiec61850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session.CVE-2026-48503 · Other software · mz-automation · reported by GitHubHigh 7.5
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an out-of-range initialPosition in fileOpen and stores it in the file-read state. The fileRead path then subtracts the larger read position from the file size using unsigned arithmetic and fails to limit the response to the actual FileSystem_readFile return value. The oversized response can include stale bytes from the reused connection buffer after the requested file contents, disclosing prior response data and protocol fragments to an unauthenticated remote client when the file service is enabled. This issue is fixed in version 1.6.2.
- Product
- libiec61850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable filesCVE-2026-95182 · Other software · reported by MITRECritical 10
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeepseek.comgist.github.com
Oct 16, 2026Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy: Sensitive Information ExposureCVE-2026-109191 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked page HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via update_option().
- Product
- Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /apCVE-2026-111383 · Other software · nezhahq · reported by VulnCheckHigh 7.1
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.
- Product
- nezha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that querCVE-2026-111312 · Other software · OpenHealthForAll · reported by VulnCheckCritical 9.2
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.
- Product
- OpenHealth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026ZoneMinder is a free, open source closed-circuit television software application.CVE-2026-104198 · Other software · ZoneMinder · reported by GitHubMedium 5.3
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped. This can dispatch views that rely on the outer authentication gate, including the zones view, which accepts an attacker-selected monitor ID and discloses monitor and zone metadata without an independent permission check. Permission helpers receive the false user value and deny privileged operations, so unauthorized state changes have not been established. This vulnerability is fixed in version 1.36.63, where conversion to ZM\User objects causes invalid token state to fail before view dispatch. Later defense-in-depth changes explicitly leave $user unset after failed token validation and reject non-ZM\User values at the web authentication gate.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Junrar is an open source Java RAR archive library.CVE-2026-97370 · Other software · junrar · reported by GitHubHigh 7.5
Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues before loop-end accounting, leaving both values unchanged. A crafted RAR4 archive can therefore keep an extraction thread in an infinite CPU loop and exhaust archive-processing worker capacity. The RAR virtual machine does not expose native process execution, so the supported impact is availability loss rather than code execution. This issue is fixed in version 7.6.1.
- Product
- junrar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs.CVE-2026-55872 · Other software · mayerbalintdev · reported by GitHubHigh 8.7
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the administrator visits /admin/users/. The persistent script can access administrator-session data or perform actions with the administrator's privileges until the stored record is removed. This issue is fixed in version 1.4.1.
- Product
- GYM-One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs.CVE-2026-55871 · Other software · mayerbalintdev · reported by GitHubMedium 6.5
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without prepared statements. An authenticated administrator can inject SQL through either search field to read data from arbitrary tables, including user information and password hashes. Depending on database permissions, the same injection may also permit filesystem writes. This issue is fixed in version 1.4.1.
- Product
- GYM-One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Tianji is an open source analytics, uptime monitoring, and server status platform.CVE-2026-55240 · Other software · msgbyte · reported by GitHubCritical 9.1
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.
- Product
- tianji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Tianji is an open source analytics, uptime monitoring, and server status platform.CVE-2026-55239 · Other software · msgbyte · reported by GitHubHigh 8.8
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.
- Product
- tianji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon.CVE-2026-111252 · Other software · The OpenNMS Group · reported by security@opennms.comMedium 6.5
A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities can expand to a very large value and exhaust the server memory. An authenticated user with provisioning access can supply such a document through a requisition or foreign-source import, which includes a remote requisition URL that the server fetches and parses. Both deeply nested entities and a single large entity referenced many times cause the memory exhaustion. The fix caps the number of entity expansions for all XML parsing and rejects any DOCTYPE in requisition and foreign-source XML. The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
- Product
- Meridian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon.CVE-2026-111235 · Other software · The OpenNMS Group · reported by security@opennms.comCritical 9.1
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication. A remote, unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. The /rest/alarms chain has the same missing deny rule and discloses whether an alarm exists through a difference in the response. The fix adds a terminal deny rule to each REST filter chain. The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
- Product
- Meridian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execuCVE-2026-111225 · Other software · Netgate · reported by VulnCheckLow 2.3
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to exCVE-2026-111224 · Other software · Netgate · reported by VulnCheckHigh 7.7
pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row cCVE-2026-111151 · Other software · aous72 · reported by VulnCheckMedium 6.9
OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row past the codeblock buffer, resulting in memory corruption and crashes.
- Product
- OpenJPH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.