Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

2,323 results · page 11 of 47

Mar 10, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-31796 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow in icCurvesFromXml() causing heap memory corruption or crash. This vulnerability is fixed in 2.3.1.5.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-31795 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow write in CIccXform3DLut::Apply() corrupting stack memory or crash. This vulnerability is fixed in 2.3.1.5.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-31794 · Other software · InternationalColorConsortium · reported by GitHubMedium 5.5
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a segmentation fault from invalid/wild pointer read in CIccCLUT::Interp3d() causing a denial of service. This vulnerability is fixed in 2.3.1.5.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-31793 · Other software · InternationalColorConsortium · reported by GitHubMedium 5.5
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a segmentation fault due to invalid/wild pointer read in CIccCalculatorFunc::ApplySequence() causing denial of service. This vulnerability is fixed in 2.3.1.5.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-31792 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a null pointer dereference in CIccTagXmlStruct::ParseTag() causing a segmentation fault or denial of service. This vulnerability is fixed in 2.3.1.5.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-30987 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow in CIccTagNum<>::GetValues() causing stack memory corruption or crash. This vulnerability is fixed in 2.3.1.5.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-30986 · Other software · InternationalColorConsortium · reported by GitHubMedium 5.5
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow write in CIccMatrixMath::SetRange() causing memory corruption or crash. This vulnerability is fixed in 2.3.1.5.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-30985 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow write in CIccMatrixMath::SetRange() causing memory corruption or crash. This vulnerability is fixed in 2.3.1.5.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-30984 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.1
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CIccCalculatorFunc::ApplySequence() causing an application crash. This vulnerability is fixed in 2.3.1.5.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-30983 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow in icFixXml() (strcpy) causing stack memory corruption or crash. This vulnerability is fixed in 2.3.1.5.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-30982 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.1
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CIccPcsXform::pushXYZConvert() causing crash and potentially leaking memory contents. This vulnerability is fixed in 2.3.1.5.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-30981 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.1
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-buffer-overflow read in CIccXmlArrayType<>::DumpArray() causing out-of-bounds read and/or crash. This vulnerability is fixed in 2.3.1.5.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-30980 · Other software · InternationalColorConsortium · reported by GitHubMedium 5.5
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack overflow in CIccBasicStructFactory::CreateStruct() causing uncontrolled recursion/stack exhaustion and crash. This vulnerability is fixed in 2.3.1.5.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-30979 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow in CIccCalculatorFunc::InitSelectOp() triggered with local user interaction causing memory corruption/crash. This vulnerability is fixed in 2.3.1.5.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-30978 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-use-after-free in CIccCmm::AddXform() causing invalid vptr dereference and crash. This vulnerability is fixed in 2.3.1.5.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2026Appium is an automation framework that provides WebDriver-based automation possibilities for a wide range platforms.CVE-2026-30973 · Other software · @appium · reported by GitHubMedium 6.5
Appium is an automation framework that provides WebDriver-based automation possibilities for a wide range platforms. Prior to 7.0.6, @appium/support contains a ZIP extraction implementation (extractAllTo() via ZipExtractor.extract()) with a path traversal (Zip Slip) check that is non-functional. The check at line 88 of packages/support/lib/zip.js creates an Error object but never throws it, allowing malicious ZIP entries with ../ path components to write files outside the intended destination directory. This affects all JS-based extractions (the default code path), not only those using the fileNamesEncoding option. This vulnerability is fixed in 7.0.6.
Product
support
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 7, 2026Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows.CVE-2026-30910 · Other software · IAMB · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined signature creation, and bin2hex functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an undersized output buffer. This can cause a crash in bin2hex and encryption algorithms other than aes256gcm. For aes256gcm encryption and signatures, an undersized buffer could lead to buffer overflow. Encountering this issue is unlikely as the message length would need to be very large. For bin2hex the input size would have to be > SIZE_MAX / 2 For aegis encryption the input size would need to be > SIZE_MAX - 32U For other encryption the input size would need to be > SIZE_MAX - 16U For signatures the input size would need to be > SIZE_MAX - 64U
Product
Crypt::Sodium::XS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record metacpan.org openwall.com
Mar 7, 2026Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows.CVE-2026-30909 · Other software · TIMLEGGE · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows. bin2hex, encrypt, aes256gcm_encrypt_afternm and seal functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an undersized output buffer. Encountering this issue is unlikely as the message length would need to be very large. For bin2hex() the bin_len would have to be > SIZE_MAX / 2 For encrypt() the msg_len would need to be > SIZE_MAX - 16U For aes256gcm_encrypt_afternm() the msg_len would need to be > SIZE_MAX - 16U For seal() the enc_len would need to be > SIZE_MAX - 64U
Product
Crypt::NaCl::Sodium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com metacpan.org
Mar 6, 2026B2BKing Premium: URL Redirection to Untrusted Site ('Open Redirect')CVE-2026-28106 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kings Plugins B2BKing Premium allows Phishing.This issue affects B2BKing Premium: from n/a before 5.4.20.
Product
B2BKing Premium
Fixed in
5.4.20
What to do
Update B2BKing Premium to 5.4.20 or newer.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Artrium: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28097 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Artrium artrium allows PHP Local File Inclusion.This issue affects Artrium: from n/a through <= 1.0.14.
Product
Artrium
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update Artrium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 2, 2026Master Addons for Elementor Premium: Remote Code ExecutionCVE-2026-3132 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.3 via the 'JLTMA_Widget_Admin::render_preview'. This is due to missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute code on the server.
Product
Master Addons for Elementor Premium
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Master Addons for Elementor Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 25, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-27692 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, heap-buffer-overflow read occurs during CIccTagTextDescription::Release() when strlen() reads past a heap buffer while parsing ICC profile XML text description tags, causing a crash. Commit 29d088840b962a7cdd35993dfabc2cb35a049847 fixes the issue. No known workarounds are available.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 25, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-27691 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.2
iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, signed integer overflow in iccFromCube.cpp during multiplication triggers undefined behavior, potentially causing crashes or incorrect ICC profile generation when processing crafted/large cube inputs. Commit 43ae18dd69fc70190d3632a18a3af2f3da1e052a fixes the issue. No known workarounds are available.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 22, 2026Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems.CVE-2026-2588 · Other software · TIMLEGGE · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems. Sodium.xs casts a STRLEN (size_t) to unsigned long long when passing a length pointer to libsodium functions. On 32-bit systems size_t is typically 32-bits while an unsigned long long is at least 64-bits.
Product
Crypt::NaCl::Sodium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 19, 2026Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS.CVE-2026-2605 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 5.3
Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS.
Product
TanOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 19, 2026Tanium addressed a SQL injection vulnerability in Asset.CVE-2026-2435 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.3
Tanium addressed a SQL injection vulnerability in Asset.
Product
Asset
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 19, 2026Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension.CVE-2026-2408 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.7
Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension.
Product
Cloud Workloads
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 19, 2026Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS.CVE-2026-2350 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS.
Product
Interact
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 19, 2026Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2026-26963 · Other software · cilium · reported by GitHubMedium 6.1
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6.
Product
cilium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 19, 2026Tanium addressed an insertion of sensitive information into log file vulnerability in Trends.CVE-2026-1292 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed an insertion of sensitive information into log file vulnerability in Trends.
Product
Trends
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 18, 2026Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF filCVE-2026-2648 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF file. (Chromium security severity: High)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Feb 17, 2026Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal.CVE-2026-1344 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal.
Product
Enforce Recovery Key Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 17, 2026Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consentCVE-2026-0102 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.1
Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses, email, or phone number metadata.
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Feb 13, 2026Google Chromium CSS Use-After-Free VulnerabilityCVE-2026-2441 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Feb 11, 2026Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium): Unauthorized loss of dataCVE-2025-13391 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'uni_cpo_remove_file' function in all versions up to, and including, 4.9.60. This makes it possible for unauthenticated attackers to delete arbitrary attachments or files stored in Dropbox if the file path is known. The vulnerability was partially patched in version 4.9.60.
Product
Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium)
Affected
up to 4.9.60
What to do
Affects up to 4.9.60. Update Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record moomoo.agency wordfence.com
Feb 9, 2026Tanium addressed an arbitrary file deletion vulnerability in end-user-cx.CVE-2025-15314 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 5.5
Tanium addressed an arbitrary file deletion vulnerability in end-user-cx.
Product
end-user-cx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 9, 2026Tanium addressed an arbitrary file deletion vulnerability in Tanium EUSS.CVE-2025-15313 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 5.5
Tanium addressed an arbitrary file deletion vulnerability in Tanium EUSS.
Product
Tanium EUSS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 9, 2026Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.CVE-2025-15310 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.8
Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.
Product
Patch Endpoint Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 9, 2026Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.CVE-2025-15319 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.8
Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.
Product
Patch Endpoint Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 9, 2026Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.CVE-2025-15318 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 5.5
Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.
Product
End-User Notifications Endpoint Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 9, 2026Tanium addressed an uncontrolled resource consumption vulnerability in Tanium Server.CVE-2025-15317 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed an uncontrolled resource consumption vulnerability in Tanium Server.
Product
Tanium Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 9, 2026Tanium addressed a local privilege escalation vulnerability in Tanium Server.CVE-2025-15316 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.7
Tanium addressed a local privilege escalation vulnerability in Tanium Server.
Product
Tanium Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 9, 2026Tanium addressed a local privilege escalation vulnerability in Tanium Module Server.CVE-2025-15315 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.7
Tanium addressed a local privilege escalation vulnerability in Tanium Module Server.
Product
Tanium Module Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 6, 2026SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems.CVE-2020-37160 · Other software · Veridium · reported by VulnCheckHigh 8.5
SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local unprivileged users can exploit missing executable files and weak service configurations to create a new administrative user and gain complete system access.
Product
SprintWork
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veridium.net veridium.net
Feb 6, 2026Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases.CVE-2025-68621 · Other software · TriliumNext · reported by GitHubHigh 7.4
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticated remote attackers to recover HMAC authentication hashes byte-by-byte through statistical timing analysis. This enables complete authentication bypass without password knowledge, granting full read/write access to victim's knowledge base. This vulnerability is fixed in 0.101.0.
Product
Trilium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 6, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-25634 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to 2.3.1.4, SrcPixel and DestPixel stack buffers overlap in CIccTagMultiProcessElement::Apply() int IccTagMPE.cpp. This vulnerability is fixed in 2.3.1.4.
Product
iccDEV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 6, 2026Tanium addressed a denial of service vulnerability in Tanium Client.CVE-2025-15320 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Low 3.3
Tanium addressed a denial of service vulnerability in Tanium Client.
Product
Tanium Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 5, 2026User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.CVE-2026-0391 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Feb 5, 2026Tanium addressed an incorrect default permissions vulnerability in Enforce.CVE-2025-15343 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Enforce.
Product
Enforce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com
Feb 5, 2026Tanium addressed an improper access controls vulnerability in Reputation.CVE-2025-15342 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.3
Tanium addressed an improper access controls vulnerability in Reputation.
Product
Reputation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tanium.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.