Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,551 results · page 10 of 212
Sep 7, 2026Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths.CVE-2026-86287 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Sep 7, 2026Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table.CVE-2026-16028 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table. When a stream reaches the CLOSED state, stream_state returns the concurrency slot and clears most of the stream's keys, but the entry itself stays in the connection stream table and nothing in the distribution removes it. Stream identifiers increase monotonically, so a peer can open and close streams on one connection indefinitely, each close leaving a residual entry that is retained for the life of the connection. SETTINGS_MAX_CONCURRENT_STREAMS does not bound this. That setting caps how many streams are live at once and is enforced, while the growth is made of streams the cap has already released, so it accumulates with concurrency never exceeding one. The client keeps the same table and grows the same way against a hostile server. Measured against a server built on this module, roughly 920 bytes are retained per closed stream for about 19 bytes on the wire, so 100,000 sequential streams on one connection grow server resident memory by about 88 MiB. The streams are ordinary requests that the application accepts and completes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Sep 7, 2026ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick.CVE-2026-86425 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial of service).
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 7, 2026ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick.CVE-2026-86423 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service).
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 7, 2026ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails.CVE-2026-86420 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 7, 2026PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients.CVE-2022-51012 · Other software · pmmp · reported by VulnCheckHigh 7.1
PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.
- Product
- PocketMine-MP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data.CVE-2022-51010 · Other software · pmmp · reported by VulnCheckHigh 7.1
PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.
- Product
- PocketMine-MP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2026MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust aCVE-2026-86304 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor. parse_assertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST->new with no cacert, cert_text or anchors argument, then passes the returned XML to Net::SAML2::Protocol::Assertion->new_from_xml with the IdP signing certificate as cacert. In Net::SAML2 before 0.86 that certificate guards only encrypted assertions, so the signature on an unencrypted assertion is checked against the certificate the response itself carries. An attacker starts a SAML login, then posts a response signed with a certificate of their own. The audience, InResponseTo and timestamp checks that follow are all satisfiable by the attacker, so the response authenticates any NameID it carries.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Sep 6, 2026Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step.CVE-2026-86219 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. server_step derives the expected digest from the client's own parameters, so a response verifies whenever its digest matches the nonce it carries. The count table it also checks is keyed on the client-supplied nonce and starts empty in each new server object, so a captured first response, carrying `nc=00000001`, passes that too. RFC 2831 defines the nonce in the response as the value the server sent in the preceding challenge. An attacker who observes one successful `qop=auth` exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orggithub.com
Sep 6, 2026PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data.CVE-2022-51009 · Other software · pmmp · reported by VulnCheckHigh 8.7
PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash.
- Product
- PocketMine-MP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint.CVE-2026-86192 · Other software · siyuan-note · reported by VulnCheckHigh 7.1
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 5, 2026NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks.CVE-2026-86176 · Other software · netbox-community · reported by VulnCheckMedium 5.3
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.
- Product
- netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates CVE-2026-86114 · Other software · getarcaneapp · reported by VulnCheckHigh 7.1
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.
- Product
- arcane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026Video Player for YouTube: Does not properly sanitise and escape user-supplied input before using it in a SQL statementCVE-2026-84937 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database.
- Product
- Video Player for YouTube
- Fixed in
- 2.1.0
- What to do
- Update Video Player for YouTube to 2.1.0 or newer.
Sep 5, 2026CatFolders Document Gallery & PDF Library: Does not properly validate a block attribute before using itCVE-2026-84930 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone who views the affected post.
- Product
- CatFolders Document Gallery & PDF Library
- Fixed in
- 2.0.7
- What to do
- Update CatFolders Document Gallery & PDF Library to 2.0.7 or newer.
Sep 5, 2026Eventin: Does not properly check authorization on several of its event-management REST routesCVE-2026-84901 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.
- Product
- Eventin
- Fixed in
- 4.1.22
- What to do
- Update Eventin to 4.1.22 or newer.
Sep 5, 2026Eventin: Does not properly validate a template path value before using it to include a local fileCVE-2026-84898 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.
- Product
- Eventin
- Fixed in
- 4.1.21
- What to do
- Update Eventin to 4.1.21 or newer.
Sep 5, 2026Bold Page Builder: Does not properly validate a link URL before outputting it in an HTML attributeCVE-2026-84021 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link.
- Product
- Bold Page Builder
- Fixed in
- 5.9.8
- What to do
- Update Bold Page Builder to 5.9.8 or newer.
Sep 5, 2026Greenshift: Does not properly escape a block animation attribute before outputting it within an HTML attributeCVE-2026-83544 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.
- Product
- Greenshift
- Fixed in
- 13.2.0
- What to do
- Update Greenshift to 13.2.0 or newer.
Sep 5, 2026JetFormBuilder — Dynamic Blocks Form Builder: Does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sendsCVE-2026-19861 · WordPress plugins & themes · reported by WPScanMedium 4.7
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrators and other recipients. Whether injected script executes depends on the recipient's mail client, but the injected markup is rendered regardless.
- Product
- JetFormBuilder — Dynamic Blocks Form Builder
- Fixed in
- 3.6.5.2
- What to do
- Update JetFormBuilder — Dynamic Blocks Form Builder to 3.6.5.2 or newer.
Sep 5, 2026JCH Optimize: Does not properly restrict a directory path provided to one of its administrative image-browsing features to within the siteCVE-2025-15693 · WordPress plugins & themes · reported by WPScanLow 2.7
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.
- Product
- JCH Optimize
- Fixed in
- 5.0.1
- What to do
- Update JCH Optimize to 5.0.1 or newer.
Sep 4, 2026In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Properly support implicit ODP rereg_mr Due to all the child mkeys in the implicitCVE-2026-80880 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Properly support implicit ODP rereg_mr Due to all the child mkeys in the implicit ODP configuration we cannot change anything in place for the parent mkey. Instead the whole thing needs to be rebuilt if any change is requested. If the user does not specify a translation then force the implicit values which will then fall through the logic into mlx5_ib_reg_user_mr() to allocate a completely new MR. Since implicit children were also touching the mr->pd, this removes another case where the access was racy.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 4, 2026Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API keysCVE-2026-85700 · Other software · onyx-dot-app · reported by VulnCheckHigh 7.1
Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/{tool_id} or GET /tool endpoints to retrieve plaintext authorization headers and third-party API credentials, then use them to directly access upstream APIs.
- Product
- onyx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters.CVE-2026-85621 · Other software · lobehub · reported by VulnCheckMedium 6.9
LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route (/api/agent/webhooks/:platform) is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verification on dispatched message events, and the Feishu adapter only performs an optional static-token comparison that is skipped when no token is configured (the default) and is not a body signature. An unauthenticated attacker who knows the public webhook URL can POST forged inbound messages with an attacker-chosen sender identity and arbitrary text, causing the bot owner's agent to process attacker-controlled input and treat the attacker as a trusted platform sender.
- Product
- lobehub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/imageCVE-2026-85605 · Other software · andrii-kryvoviaz · reported by VulnCheckMedium 6.9
Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/{imageId}/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on public images and subscribe to live comment updates without authentication or authorization checks.
- Product
- slink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs.CVE-2026-19081 · Other software · Gastromenum · reported by iletisim@usom.gov.trMedium 4.3
Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31.
- Product
- Gastromenum Ticket and QR Menu System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not boCVE-2026-82309 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 4.3
Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries. _check_dns issues one PTR query for the client address, keeps the returned names matching the rule's domain, and issues a forward query for each until one resolves back to that address. Nothing bounds that list, and a client controls the reverse zone for its own address, so it chooses how many names the PTR answer holds. Net::DNS refetches a truncated answer over TCP by default, so the 512-byte UDP payload does not cap it either. Any client whose User-Agent matches a rule with a domain reaches _check_dns. Each forward name is distinct and client-chosen, so every query misses the local cache and is resolved against the authoritative servers for that domain. The queries are synchronous, so the caller is held until all of them answer or time out.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code bCVE-2026-85610 · Other software · Openpanel-dev · reported by VulnCheckHigh 8.7
OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to load Node.js built-ins and execute operating system commands with the privileges of the API process, bypassing organization authorization boundaries.
- Product
- openpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 4, 2026ePayco Payment Gateway for WooCommerce: Does not properly verify the authenticity of payment confirmation requestsCVE-2026-84043 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature.
- Product
- ePayco Payment Gateway for WooCommerce
- Fixed in
- 8.4.7
- What to do
- Update ePayco Payment Gateway for WooCommerce to 8.4.7 or newer.
Sep 4, 2026WPLP Cookie Consent: Does not properly validate a pagination parameter before using it in a SQL queryCVE-2026-82186 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 4, 2026Frontend Admin by DynamiApps: Does not properly validate a user-controllable directory path before deleting files within itCVE-2026-81347 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.
- Product
- Frontend Admin by DynamiApps
- Fixed in
- 3.29.13
- What to do
- Update Frontend Admin by DynamiApps to 3.29.13 or newer.
Sep 3, 2026MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the sCVE-2026-85456 · Other software · moos-ivp · reported by VulnCheckMedium 6.8
MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems.
- Product
- moos-ivp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners atCVE-2026-85433 · Other software · themoos · reported by VulnCheckCritical 9.3
MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARE_CMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary addresses and redirect or duplicate bus traffic to attacker-controlled destinations.
- Product
- essential-moos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtCVE-2026-9744 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.
- Product
- Netezza Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtCVE-2026-9036 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.
- Product
- Netezza Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix compariCVE-2026-85396 · Other software · rubyzip · reported by VulnCheckHigh 8.7
rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.
- Product
- rubyzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixCVE-2026-85394 · Other software · mpdavis · reported by VulnCheckCritical 9.3
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.
- Product
- python-jose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrarCVE-2026-85388 · Other software · Worklenz · reported by VulnCheckHigh 8.6
Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.
- Product
- worklenz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videoCVE-2026-85156 · Other software · WWBN · reported by VulnCheckMedium 6.9
WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video content that should be hidden, including full URLs to unlisted videos and thumbnails of member-only content, regardless of the operator's hidePrivateVideos setting.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 3, 2026XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improperly restrict XML exteCVE-2026-82918 · Other software · Keyence Corporation · reported by vultures@jpcert.or.jpMedium 6.7
XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the sensitive information stored in the system where the affected product is installed may be disclosed.
- Product
- XG-X VisionTerminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Xpro Addons: Does not properly escape some of its widgets' settings before outputting them within HTML attributesCVE-2026-83547 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Xpro Addons
- Fixed in
- 1.7.4
- What to do
- Update Xpro Addons to 1.7.4 or newer.
Sep 2, 2026Embed HTML5 Game: Does not properly restrict who can upload files via the pluginCVE-2026-4357 · WordPress plugins & themes · reported by WPScanCritical 10
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.
- Product
- Embed HTML5 Game
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Embed HTML5 Game to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Icegram Express: Does not properly escape a list description setting before outputting it within an HTML attributeCVE-2025-15692 · WordPress plugins & themes · reported by WPScanLow 3.5
The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Icegram Express
- Fixed in
- 5.8.6
- What to do
- Update Icegram Express to 5.8.6 or newer.
Sep 2, 2026Passster: Does not handle input properly in an AJAX actionCVE-2025-15489 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content
- Product
- Passster
- Fixed in
- 4.2.24
- What to do
- Update Passster to 4.2.24 or newer.
Sep 2, 2026Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints.CVE-2026-84804 · Other software · kimai · reported by VulnCheckMedium 5.3
Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.
- Product
- kimai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 2, 2026MasterStudy LMS: Does not properly verify ownership of a curriculum object before acting on itCVE-2026-81198 · WordPress plugins & themes · reported by WPScanLow 3.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other instructors.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.46
- What to do
- Update MasterStudy LMS to 3.7.46 or newer.
Sep 2, 2026MasterStudy LMS: Does not properly verify ownership of quiz question identifiersCVE-2026-81196 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.46
- What to do
- Update MasterStudy LMS to 3.7.46 or newer.
Sep 2, 2026MasterStudy LMS: Does not properly verify authorizationCVE-2026-81194 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.46
- What to do
- Update MasterStudy LMS to 3.7.46 or newer.
Sep 2, 2026GamiPress: Does not properly restrict its video watch-tracking functionalityCVE-2026-77764 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them without limit.
- Product
- GamiPress
- Fixed in
- 7.9.9.6
- What to do
- Update GamiPress to 7.9.9.6 or newer.
Sep 2, 2026Social Media Share Buttons & Social Sharing Icons: Does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handlerCVE-2026-19723 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.
- Product
- Social Media Share Buttons & Social Sharing Icons
- Fixed in
- 3.0.1
- What to do
- Update Social Media Share Buttons & Social Sharing Icons to 3.0.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.