Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,823 results · page 11 of 137
Jul 16, 2026WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticatCVE-2026-63089 · Other software · wg-easy · reported by VulnCheckCritical 9
WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as the token is computed using CRC32 over a random value constrained to 0-999. Attackers can enumerate candidate tokens against the unauthenticated /cnf/:oneTimeLink route, which lacks rate limiting and does not validate token expiration, to obtain a peer's PrivateKey and PresharedKey and impersonate that peer on the VPN network.
- Product
- wg-easy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet class, allowing authenticated user to expCVE-2025-45870 · Other software · reported by MITREMedium 6.5
LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized access to sensitive files outside the designated directories.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlogicaldoc.com
Jul 16, 2026LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the ComparisonServlet component, allowing authenticated user to manipulate SQCVE-2025-45868 · Other software · reported by MITREHigh 8.8
LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the ComparisonServlet component, allowing authenticated user to manipulate SQL queries via crafted input.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlogicaldoc.com
Jul 16, 2026An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools).CVE-2026-9494 · Other software · Canonical · reported by security@ubuntu.comMedium 5.5
An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.
- Product
- ubuntu-pro-client (ubuntu-advantage-tools)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command frameworCVE-2026-12391 · Other software · Canonical · reported by security@ubuntu.comMedium 5
An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.
- Product
- ubuntu-pro-client (ubuntu-advantage-tools)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools).CVE-2026-11386 · Other software · Canonical · reported by security@ubuntu.comCritical 9
An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is pr
- Product
- ubuntu-pro-client (ubuntu-advantage-tools)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server ticCVE-2025-56362 · Other software · Csa-iot · reported by MITREMedium 5.7
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server tick logic. When a MoveToLevel command is sent and immediately followed by a write of OperationMode=2 (in the Pump Configuration and Control cluster), the server tick function violates the assertion `currentLevel < maxLevel`, resulting in a crash. This can be exploited remotely without authentication to cause denial of service. Affected versions include 1.3 and 1.4 (commit ab3d5ae).
- Product
- Matter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic (CVE-2025-56361 · Other software · Csa-iot · reported by MITREMedium 5.7
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic (`emberAfLevelControlClusterServerTickCallback`). When a MoveToLevel command is executed and followed by a conflicting write to the OperationMode attribute (in the Pump Configuration and Control cluster), an invariant check (`minLevel < currentLevel`) fails and causes the device to abort. This leads to a denial of service condition. The issue is confirmed in SDK versions 1.3 and 1.4 (commit ab3d5ae), and is triggered remotely without authentication.
- Product
- Matter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the curreCVE-2026-48325 · Websites & servers · Adobe · reported by AdobeCritical 9.3
ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function.CVE-2026-24259 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.4
NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- TensorRT-LLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass.CVE-2026-48252 · Other software · Adobe · reported by AdobeHigh 8.6
Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.CVE-2026-58528 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-50668 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to elevate privileges with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.CVE-2026-50661 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code with a physical attack.CVE-2026-50492 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.CVE-2026-50453 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Missing authentication for critical function in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.CVE-2026-50451 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Missing authentication for critical function in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Missing authentication for critical function in Windows Server Update Service allows an authorized attacker to elevate privileges over a network.CVE-2026-50444 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Missing authentication for critical function in Windows Server Update Service allows an authorized attacker to elevate privileges over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges with a physical attack.CVE-2026-50374 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.3
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges with a physical attack.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.CVE-2026-57969 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
- Product
- Azure CycleCloud 8.9.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack.CVE-2026-57097 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.4
Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Microsoft SharePoint Server Missing Authentication for Critical Function VulnerabilityCVE-2026-56164 · Email & office · Microsoft · reported by secure@microsoft.comExploitedMedium 5.3
Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.
- Product
- SharePoint Server
- On CISA’s list since
- Jul 14, 2026 (federal fix deadline Jul 17, 2026)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comcisa.gov
Jul 14, 2026Use after free in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-55000 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.4
Use after free in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-54132 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.CVE-2026-50333 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to execute code with a physical attack.CVE-2026-50299 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to execute code with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Integer overflow or wraparound in Windows Spaceport.sys allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-50298 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Integer overflow or wraparound in Windows Spaceport.sys allows an unauthorized attacker to elevate privileges with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Heap-based buffer overflow in Windows USB Video Driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-49804 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.6
Heap-based buffer overflow in Windows USB Video Driver allows an unauthorized attacker to elevate privileges with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.CVE-2026-49794 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.6
Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.CVE-2026-49174 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-49168 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to elevate privileges with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documenCVE-2026-59084 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.
- Product
- Apache Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jul 14, 2026SureForms: Does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amountCVE-2026-11567 · WordPress plugins & themes · reported by WPScanMedium 5.9
The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.
- Product
- SureForms
- Fixed in
- 2.11.1
- What to do
- Update SureForms to 2.11.1 or newer.
Jul 13, 2026SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lCVE-2026-44747 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.9
SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized data access, modification, or system unavailability. This has high impact on confidentiality, integrity, and availability of the application.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (SSRF).CVE-2025-45869 · Other software · reported by MITREHigh 7.3
LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can exploit the ShareFileCallback servlet by manipulating input parameters to trigger a server-side request to an attacker-controlled host.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlogicaldoc.com
Jul 13, 2026Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function.CVE-2026-6847 · Other software · 4real · reported by cvd@cert.plCritical 9.3
Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload and to execute arbitrary code on the underlying server. This issue has been fixed by a patch released in April 2026.
- Product
- ThemisNETPanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability.CVE-2026-12257 · Other software · Mura Software · reported by cve-coordination@incibe.esCritical 9.3
Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitised before being processed by the ColdFusion engine. As a result, a remote attacker could exploit this vulnerability to inject and execute arbitrary CFML (ColdFusion Markup Language) expressions and instantiate malicious Java objects, thereby compromising the system’s security.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution.CVE-2026-14453 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7Critical 9.6
This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm field is stored without sanitization and rendered via Smarty with no security policy enabled, allowing any authenticated user, to inject and execute arbitrary code on the server. This results in disclosure of environment secrets and could impact platform availability of Centreon Infra Monitoring product.
- Product
- Infra Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2026Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list) of dynamically allCVE-2026-10667 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgHigh 7.8
Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list) of dynamically allocated kernel objects. Iteration over this list in k_object_wordlist_foreach() was performed under lists_lock using the SAFE iterator (which caches the next node), but list removal and freeing of nodes was performed under different, disjoint spinlocks: objfree_lock in k_object_free() and obj_lock in unref_check(). On an SMP system, while one CPU iterated obj_list under lists_lock, another CPU could unlink and k_free() the dyn_obj node that the iterator had cached as its next pointer, causing the iterator to dereference freed kernel memory (use-after-free / dangling list traversal). All of the racing operations are reachable from unprivileged user-mode threads via system calls: k_object_alloc/k_object_alloc_size and k_object_release drive removals through unref_check() (under obj_lock), while k_thread_abort and thread creation drive the iteration through k_thread_perms_all_clear()/k_thread_perms_inherit() (under lists_lock). A deprivileged user thread on a CONFIG_SMP + CONFIG_USERSPACE build can therefore corrupt the kernel's
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2026PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-leveCVE-2026-61439 · Other software · MervinPraison · reported by VulnCheckHigh 8.7
PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass through unblocked. Attackers can submit single-vector prompt injection attacks such as instruction overrides or financial manipulation that trigger HIGH severity detection but are logged without blocking, enabling system prompt extraction and unauthorized tool invocations.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection.CVE-2026-55810 · Websites & servers · reported by mlhess@drupal.orgHigh 8.1
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection.CVE-2026-55809 · Websites & servers · reported by mlhess@drupal.orgHigh 8.1
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.CVE-2026-55804 · Websites & servers · reported by mlhess@drupal.orgMedium 5.9
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.CVE-2026-55803 · Websites & servers · reported by mlhess@drupal.orgMedium 5.9
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection.CVE-2026-15083 · Websites & servers · reported by mlhess@drupal.orgMedium 4.2
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection.CVE-2026-13244 · Websites & servers · reported by mlhess@drupal.orgHigh 8.1
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection.CVE-2026-12535 · Websites & servers · reported by mlhess@drupal.orgCritical 9.8
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object InjectiCVE-2026-9726 · Websites & servers · reported by mlhess@drupal.orgCritical 9.8
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Lima launches Linux virtual machines, typically on macOS, for running containerd.CVE-2026-53657 · Other software · lima-vm · reported by GitHubHigh 8.2
Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addresses, including Unix socket addresses for privileged daemons like D-Bus. This issue is fixed in version 2.1.3.
- Product
- lima
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and dCVE-2026-60089 · Other software · MervinPraison · reported by VulnCheckMedium 6.9
PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.output_file path. A repository-controlled config file can set output_file to an absolute or '..' traversal path; when the developer subsequently calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to that path (creating parent directories as needed), allowing an untrusted checked-out project to overwrite files outside the project root with the privileges of the user running PraisonAI.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.