Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16,428 results · page 100 of 329
Feb 11, 2026A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to modify External Global Memory Interconnect TrusCVE-2023-31324 · Other software · AMD · reported by psirt@amd.comHigh 7.1
A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to modify External Global Memory Interconnect Trusted Agent (XGMI TA) commands as they are processed potentially resulting in loss of confidentiality, integrity, or availability.
- Product
- AMD Radeon™ RX 5000 Series Graphics Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to corrupt memory resulting in loss of integrity, CVE-2023-20548 · Other software · AMD · reported by psirt@amd.comHigh 7.1
A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to corrupt memory resulting in loss of integrity, confidentiality, or availability.
- Product
- AMD Radeon™ RX 5000 Series Graphics Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Improper handling of parameters in the AMD Secure Processor (ASP) could allow a privileged attacker to pass an arbitrary memory value to functions in the trusteCVE-2023-20514 · Other software · AMD · reported by psirt@amd.comHigh 8.7
Improper handling of parameters in the AMD Secure Processor (ASP) could allow a privileged attacker to pass an arbitrary memory value to functions in the trusted execution environment resulting in arbitrary code execution
- Product
- AMD Radeon™ RX 6000 Series Graphics Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a denCVE-2026-1507 · Other software · AVEVA · reported by ics-cert@hq.dhs.govHigh 8.7
The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a denial-of-service.
- Product
- PI Data Archive PI Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writes, potentially resulCVE-2025-0029 · Other software · AMD · reported by psirt@amd.comLow 1.8
Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writes, potentially resulting in a loss of SEV-SNP guest memory integrity
- Product
- AMD EPYC™ 9005 Series Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents.CVE-2026-1849 · Other software · MongoDB Inc · reported by cna@mongodb.comHigh 7.1
MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic-CVE-2026-23906 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic-security extension enabled * LDAP authenticator configured * Underlying LDAP server permits anonymous bind Vulnerability Description An authentication bypass vulnerability exists in Apache Druid when using the druid-basic-security extension with LDAP authentication. If the underlying LDAP server is configured to allow anonymous binds, an attacker can bypass authentication by providing an existing username with an empty password. This allows unauthorized access to otherwise restricted Druid resources without valid credentials. The vulnerability stems from improper validation of LDAP authentication responses when anonymous binds are permitted, effectively treating anonymous bind success as valid user authentication. Impact A remote, unauthenticated attacker can: * Gain unauthorized access to the Apache Druid cluster * Access sensitive data stored in Druid data
- Product
- Apache Druid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25875 · Other software · Praskla-Technology · reported by GitHubCritical 9.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The admin authorization middleware trusts client-controlled JWT claims (role and scope) without enforcing server-side role verification.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25814 · Other software · Praskla-Technology · reported by GitHubCritical 9.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query parameters are passed directly into DynamoDB query/filter construction without validation or sanitization.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25813 · Other software · Praskla-Technology · reported by GitHubHigh 8.7
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data directly to console output without masking or redaction.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25812 · Other software · Praskla-Technology · reported by GitHubCritical 9.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application enables credentialed CORS requests but does not implement any CSRF protection mechanism.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25811 · Other software · Praskla-Technology · reported by GitHubMedium 5.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from the email domain provided by the user, without validating domain ownership or registration. This allows cross-tenant data access.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25876 · Other software · Praskla-Technology · reported by GitHubMedium 5.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/results.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks). For example, this can be used to return all results for an assessment.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25810 · Other software · Praskla-Technology · reported by GitHubMedium 5.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/student.submission.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks).
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25809 · Other software · Praskla-Technology · reported by GitHubMedium 5.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has started, is not expired, or the submission window is currently open.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25806 · Other software · Praskla-Technology · reported by GitHubMedium 5.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email PUT /api/students/:email/status, and DELETE /api/students/:email routes in backend/src/routes/student.routes.ts only enforce authentication using authenticateToken but do not enforce authorization. The application does not verify whether the authenticated user owns the student record being accessed, has an administrative / staff role, or is permitted to modify or delete the target student.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Insertion of Sensitive Information Into Sent Data vulnerability in Atlas Educational Software Industry Ltd.CVE-2025-7708 · Other software · Atlas Educational Software Industry Ltd. Co. · reported by iletisim@usom.gov.trMedium 6.8
Insertion of Sensitive Information Into Sent Data vulnerability in Atlas Educational Software Industry Ltd. Co. K12net allows Communication Channel Manipulation. This issue affects k12net: through 26072025.
- Product
- k12net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 9, 2026Products provided by Oki Electric Industry Co., Ltd.CVE-2026-24466 · Other software · Oki Electric Industry Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
Products provided by Oki Electric Industry Co., Ltd. and its OEM products (Ricoh Co., Ltd., Murata Machinery, Ltd.) register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
- Product
- See "References" section
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026A vulnerability was identified in Portabilis i-Educar up to 2.10.CVE-2026-2064 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.php of the component User Data Page. Such manipulation of the argument File leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25753 · Other software · Praskla-Technology · reported by GitHubCritical 9.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application uses a hard-coded, static default password for all newly created student accounts. This results in mass account takeover, allowing any attacker to log in as any student once the password is known.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026A weakness has been identified in Portabilis i-Educar up to 2.10.CVE-2026-2015 · Other software · Portabilis · reported by VulDBLow 2.1
A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument school_id can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.11.0 is able to address this issue. Upgrading the affected component is advised. The vendor explains, that "[t]he reported attack vector was tested against the corrected code, and the previously described behavior could no longer be reproduced".
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Nsauditor Product Key Explorer 4.2.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by inputting a specially CVE-2020-37131 · Other software · Nsauditor · reported by VulnCheckMedium 6.7
Nsauditor Product Key Explorer 4.2.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by inputting a specially crafted registration key. Attackers can generate a payload of 1000 bytes of repeated characters and paste it into the 'Key' input field to trigger the application crash.
- Product
- Product Key Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnsauditor.comexploit-db.com
Feb 4, 2026ProShow Producer 9.0.3797 contains an unquoted service path vulnerability in the ScsiAccess service that allows local attackers to potentially execute arbitraryCVE-2019-25274 · Other software · Photodex · reported by VulnCheckHigh 8.5
ProShow Producer 9.0.3797 contains an unquoted service path vulnerability in the ScsiAccess service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be run with LocalSystem privileges during service startup.
- Product
- ProShow Producer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphotodex.comexploit-db.com
Feb 4, 2026Locutus brings stdlibs of other programming languages to JavaScript for educational purposes.CVE-2026-25521 · Other software · locutusjs · reported by GitHubCritical 9.4
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.
- Product
- locutus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-siteCVE-2026-20111 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.8
A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against users of the interface of an affected system. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious code into specific data fields in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, an attacker must have valid administrative credentials.
- Product
- Cisco Prime Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Feb 4, 2026If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data.CVE-2026-24447 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpMedium 4.8
If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user's environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
- Product
- Movable Type (Software Edition)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.CVE-2026-25510 · Other software · ci4-cms-erp · reported by GitHubCritical 9.9
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, an authenticated user with file editor permissions can achieve Remote Code Execution (RCE) by leveraging the file creation and save endpoints, an attacker can upload and execute arbitrary PHP code on the server. This issue has been patched in version 0.28.5.0.
- Product
- ci4ms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.CVE-2026-25509 · Other software · ci4-cms-erp · reported by GitHubMedium 5.3
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, the authentication implementation in CI4MS is vulnerable to email enumeration. An unauthenticated attacker can determine whether an email address is registered in the system by analyzing the application's response during the password reset process. This issue has been patched in version 0.28.5.0.
- Product
- ci4ms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026PhpIX 2012 Professional contains a SQL injection vulnerability in the 'id' parameter of product_detail.php that allows remote attackers to manipulate database qCVE-2020-37108 · Other software · AllHandsMarketing · reported by VulnCheckHigh 7.1
PhpIX 2012 Professional contains a SQL injection vulnerability in the 'id' parameter of product_detail.php that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the 'id' parameter to potentially extract or modify database information.
- Product
- PhpIX 2012 Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordallhandsmarketing.compcollectionnecktie.com
Feb 3, 2026Advanced WooCommerce Product Sales Reporting: Insertion of Sensitive Information Into Sent DataCVE-2026-24992 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows Retrieve Embedded Sensitive Data.This issue affects Advanced WooCommerce Product Sales Reporting: from n/a through <= 4.1.2.
- Product
- Advanced WooCommerce Product Sales Reporting
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update Advanced WooCommerce Product Sales Reporting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2026OS command injection vulnerability exists in ELECOM wireless LAN products.CVE-2026-22550 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpHigh 8.6
OS command injection vulnerability exists in ELECOM wireless LAN products. A crafted request from a logged-in user may lead to an arbitrary OS command execution.
- Product
- WRC-X6000XS-G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Cross-site request forgery vulnerability exists in ELECOM wireless LAN products.CVE-2026-20704 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.1
Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed.
- Product
- WRC-X1500GS-B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2026Webile 1.0.1 contains a directory traversal vulnerability that allows remote attackers to manipulate file system paths without authentication.CVE-2022-50950 · Other software · Product Owner: Webile · reported by VulnCheckHigh 7.1
Webile 1.0.1 contains a directory traversal vulnerability that allows remote attackers to manipulate file system paths without authentication. Attackers can exploit path manipulation to access sensitive system directories and potentially compromise the mobile device's local file system.
- Product
- Webile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordplay.google.comvulncheck.com
Feb 1, 2026Ultimate POS 4.4 contains a persistent cross-site scripting vulnerability in the product name parameter that allows remote attackers to inject malicious scriptsCVE-2021-47908 · Other software · thewebfosters · reported by VulnCheckMedium 5.1
Ultimate POS 4.4 contains a persistent cross-site scripting vulnerability in the product name parameter that allows remote attackers to inject malicious scripts. Attackers can exploit the vulnerability through product add or edit functions to execute arbitrary JavaScript and potentially hijack user sessions.
- Product
- Unknown
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordultimatefosters.comvulncheck.com
Jan 30, 2026Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can cause abnormal device behavior by craftCVE-2026-22626 · Other software · HIKSEMI · reported by hsrc@hikvision.comMedium 4.9
Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can cause abnormal device behavior by crafting specific messages.
- Product
- HS-AFS-S1H1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026Improper handling of filenames in certain HIKSEMI NAS products may lead to the exposure of sensitive system files.CVE-2026-22625 · Other software · HIKSEMI · reported by hsrc@hikvision.comMedium 4.6
Improper handling of filenames in certain HIKSEMI NAS products may lead to the exposure of sensitive system files.
- Product
- HS-AFS-S1H1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file resources without proper authorization.CVE-2026-22624 · Other software · HIKSEMI · reported by hsrc@hikvision.comMedium 4.3
Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file resources without proper authorization.
- Product
- HS-AFS-S1H1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary commands on the devicCVE-2026-22623 · Other software · HIKSEMI · reported by hsrc@hikvision.comHigh 7.2
Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary commands on the device by crafting specific messages.
- Product
- HS-AFS-S1H1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telnet service on the box.CVE-2026-24714 · Network & remote access · NETGEAR · reported by vultures@jpcert.or.jpHigh 8.7
Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telnet service on the box.
- Product
- NETGEAR products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026pwn.college DOJO is an education platform for learning cybersecurity.CVE-2026-25117 · Other software · pwncollege · reported by GitHubHigh 8.3
pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as `http[:]//dojo[.]website`. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue.
- Product
- dojo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to obtain the logs of the affected product CVE-2025-55704 · Other software · Brother Industries, Ltd. · reported by vultures@jpcert.or.jpMedium 6.9
Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to obtain the logs of the affected product and obtain sensitive information within the logs.
- Product
- Multiple MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfaq.brother.co.jpjvn.jp
Jan 28, 2026Default credentials vulnerability exists in SuprOS product.CVE-2025-7740 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 8.8
Default credentials vulnerability exists in SuprOS product. If exploited, this could allow an authenticated local attacker to use an admin account created during product deployment.
- Product
- SuprOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Jan 27, 2026This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server.CVE-2026-21569 · Websites & servers · Atlassian · reported by security@atlassian.comHigh 7.9
This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Crowd Data Center and Server 7.1: Upgrade to a release greater than or equal to 7.1.3 See the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center and Server from the download center (https://www.atlassian.com/software/crowd/download-archive). This vulnerability was reported via our Atlassian (Internal) program.
- Product
- Crowd Data Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconfluence.atlassian.comjira.atlassian.com
Jan 27, 2026Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2026-24858 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
- Product
- Multiple Products
- On CISA’s list since
- Jan 27, 2026 (federal fix deadline Jan 30, 2026)
- What to do
- Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogfortiguard.fortinet.comcert-portal.siemens.com
Jan 23, 2026Smart Product Viewer: Missing AuthorizationCVE-2026-24588 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in topdevs Smart Product Viewer smart-product-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Product Viewer: from n/a through <= 1.5.4.
- Product
- Smart Product Viewer
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Smart Product Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Ryviu – Product Reviews for WooCommerce: Missing AuthorizationCVE-2026-24562 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ryviu Ryviu – Product Reviews for WooCommerce ryviu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ryviu – Product Reviews for WooCommerce: from n/a through <= 3.1.26.
- Product
- Ryviu – Product Reviews for WooCommerce
- Affected
- up to 3.1.26
- What to do
- Affects up to 3.1.26. Update Ryviu – Product Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Authorization Bypass Through User-Controlled Key vulnerability in EXERT Computer Technologies Software Ltd.CVE-2025-10024 · Other software · EXERT Computer Technologies Software Ltd. Co. · reported by iletisim@usom.gov.trHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in EXERT Computer Technologies Software Ltd. Co. Education Management System allows Parameter Injection. This issue affects Education Management System: through 23.09.2025.
- Product
- Education Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jan 21, 2026Realtek Wireless LAN Utility 700.1631 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system pCVE-2021-47880 · Network & remote access · Realtek Semiconductor Corp. · reported by VulnCheckHigh 8.5
Realtek Wireless LAN Utility 700.1631 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted service path by inserting malicious code in the system root path that would execute during application startup or system reboot.
- Product
- Realtek Wireless LAN Utility
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comrealtek.com
Jan 21, 2026eBeam Education Suite 2.5.0.9 contains an unquoted service path vulnerability in the eBeam Device Service that allows local users to potentially execute code wiCVE-2021-47878 · Other software · Luidia · reported by VulnCheckHigh 8.5
eBeam Education Suite 2.5.0.9 contains an unquoted service path vulnerability in the eBeam Device Service that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious code that would execute with LocalSystem privileges during service startup.
- Product
- eBeam Education Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordesvc000385.wic045u.server-web.comexploit-db.com
Jan 21, 2026Cisco Unified Communications Products Code Injection VulnerabilityCVE-2026-20045 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.2
Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.
- Product
- Unified Communications Manager
- On CISA’s list since
- Jan 21, 2026 (federal fix deadline Feb 11, 2026)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsec.cloudapps.cisco.comcisa.gov
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.