Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,791 results · page 11 of 116
Aug 20, 2026OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitraryCVE-2026-76156 · Other software · Datiphy Inc. · reported by ART@zuso.aiCritical 9.4
OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root.
- Product
- Data Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the managementCVE-2026-76155 · Other software · Datiphy Inc. · reported by ART@zuso.aiCritical 9.3
Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials.
- Product
- Data Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitraryCVE-2026-53804 · Other software · Centuran Consulting · reported by VulnCheckHigh 8.6
OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration values are concatenated without sanitization into a shell command, enabling arbitrary command execution as the web server process user during normal ticket operations after the malicious configuration is deployed.
- Product
- OTRS Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh00die-gr3y.github.iovulncheck.com
Aug 20, 2026baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled tabCVE-2026-76635 · Other software · baserproject · reported by VulnCheckHigh 8.6
baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations. Attackers can chain a backup restore code injection flaw, where PHP code outside class definitions in schema files executes unconditionally upon loading, to plant malicious table names and trigger error-based SQL injection that retrieves database version, schema contents, and arbitrary data from the PostgreSQL backend.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outside the intended logCVE-2026-64967 · Other software · ATutor · reported by cvd@cert.plMedium 6.9
A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outside the intended logs directory. This can lead to unauthorized access to sensitive files and other resources accessible to the web server process. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
- Product
- ATutor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordatutor.github.iocert.pl
Aug 20, 2026A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext sesCVE-2026-14948 · Other software · Frauscher Sensortechnik · reported by info@cert.vde.comHigh 8.7
A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives.
- Product
- FDS 102
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands dCVE-2025-14601 · Other software · vsDesk · reported by vulnerability@kaspersky.comHigh 8.6
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
- Product
- vsDesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../check_connectivity endpoint to make SplunCVE-2026-76361 · Other software · Splunk · reported by psirt@cisco.comLow 2.7
In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../check_connectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The Server-Side Request Forgery (SSRF) is possible because the connectivity check REST API does not sufficiently validate the destination before Splunk SOAR connects to it. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
- Product
- Splunk SOAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026In Splunk SOAR versions below 8.6.0, a user who holds the Administrator role could use path traversal in the Universal Forwarder installer's archive extraction CVE-2026-76359 · Other software · Splunk · reported by psirt@cisco.comMedium 6.5
In Splunk SOAR versions below 8.6.0, a user who holds the Administrator role could use path traversal in the Universal Forwarder installer's archive extraction to write files outside the intended installation directory. The vulnerability is possible because the Universal Forwarder credentials-package extraction workflow does not verify that each archive member remains within the intended destination before extraction. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Configure forwarders to send SOAR data to your Splunk deployment (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/configure-administration-settings-in-splunk-soar-on-premises/configure-forwarders-to-send-soar-data-to-your-splunk-deployment) in the Splunk documentation.
- Product
- Splunk SOAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker with administrative CVE-2026-4937 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker with administrative privileges to decrypt encrypted data due to certain hypervisor calls utilizing less entropy than requested.
- Product
- PowerVM Hypervisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due tCVE-2026-19875 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access.CVE-2025-14600 · Other software · vsDesk · reported by vulnerability@kaspersky.comCritical 9.3
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.
- Product
- vsDesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step.CVE-2026-76242 · Other software · eidetic-labs · reported by VulnCheckCritical 9.1
stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can register a malicious peer and gain access to or tamper with federation traffic. Fixed in 0.9.0a2, which introduces a pending approval flow requiring administrator fingerprint verification before peer tokens are accepted.
- Product
- stigmem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 19, 2026CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interCVE-2026-18372 · Other software · M-Files Corporation · reported by security@m-files.comMedium 4.8
CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users.
- Product
- M-Files Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026ProSolution WP Client: Does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pagesCVE-2026-19056 · WordPress plugins & themes · reported by WPScanHigh 7.1
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.
- Product
- ProSolution WP Client
- Fixed in
- 2.0.11
- What to do
- Update ProSolution WP Client to 2.0.11 or newer.
Aug 19, 2026An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges.CVE-2026-70408 · Other software · Extra Innovation Inc. · reported by vultures@jpcert.or.jpHigh 8.7
An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges.
- Product
- acmailer CGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Vulnerability in the PeopleSoft Enterprise FIN Lease Administration product of Oracle PeopleSoft (component: Lease Administration).CVE-2026-71092 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the PeopleSoft Enterprise FIN Lease Administration product of Oracle PeopleSoft (component: Lease Administration). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Lease Administration executes to compromise PeopleSoft Enterprise FIN Lease Administration. While the vulnerability is in PeopleSoft Enterprise FIN Lease Administration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Lease Administration accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Lease Administration accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
- Product
- PeopleSoft Enterprise FIN Lease Administration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Froxlor is open source server administration software.CVE-2026-62988 · Other software · froxlor · reported by GitHubCritical 9
Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and lib/Froxlor/Api/Commands/Ftps.php retrieve full database rows and return them without removing password and data_2fa fields. An authenticated API caller with permission to use these endpoints can obtain customer, administrator, and FTP password hashes as well as Base32-encoded TOTP seeds for administrator and customer accounts. Password hashes can be cracked offline, and TOTP seeds can generate valid second-factor codes until two-factor authentication is reset. Exposure of both values for an account can enable takeover of the hosting panel or hosted resources and can defeat both authentication factors. This issue is fixed in version 2.3.8.
- Product
- froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival).CVE-2026-62587 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival). Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Administration. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Administration accessible data as well as unauthorized update, insert or delete access to some of Siebel CRM Administration accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
- Product
- Siebel CRM Administration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival).CVE-2026-62586 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.6
Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival). Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Administration. While the vulnerability is in Siebel CRM Administration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Administration accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
- Product
- Siebel CRM Administration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival).CVE-2026-62585 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.8
Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival). Supported versions that are affected are 25.12-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Administration. Successful attacks of this vulnerability can result in takeover of Siebel CRM Administration. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Product
- Siebel CRM Administration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Froxlor is open source server administration software.CVE-2026-55593 · Other software · froxlor · reported by GitHubMedium 6.5
Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The editapikey action in Ajax::editApiKey updates allowed_from and valid_until without validating a CSRF token, while templates/Froxlor/assets/js/jquery/apikeys.js sends no token because the endpoint does not require one. An unauthenticated attacker can induce an authenticated administrator's browser to submit a forged request that adds an attacker-controlled address to an API key's allowed_from list or removes its expiration, weakening the key's security restrictions. This issue is fixed in version 2.3.8.
- Product
- froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Froxlor is open source server administration software.CVE-2026-54543 · Other software · froxlor · reported by GitHubMedium 5.4
Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before lib/Froxlor/Dns/DnsEntry.php serializes the values into a BIND zone file. An authenticated customer with DNS-zone permissions can place a crafted value in the record field, or use the related type-field variant, to create additional resource-record lines that bypass Froxlor's field-level validation. BIND accepts the injected records, allowing modification of DNS data and possible DNS availability impact within a zone the caller is authorized to manage. This issue is fixed in version 2.3.8.
- Product
- froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Froxlor is open source server administration software.CVE-2026-54348 · Other software · froxlor · reported by GitHubHigh 7.2
Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in panel_admins.ip without enforcing numeric element types. When the poisoned account later calls IpsAndPorts.listing, lib/Froxlor/Api/Commands/IpsAndPorts.php decodes the array and concatenates its elements into a SQL IN clause without casting or parameterization; the same unsafe pattern is present in lib/Froxlor/Api/Commands/Domains.php. An authenticated administrator with change_serversettings permission can store a UNION-based payload and trigger it through the poisoned account to retrieve arbitrary database data, including administrator login names and bcrypt password hashes, with potential privilege escalation and broader database impact. This issue is fixed in version 2.3.8.
- Product
- froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Froxlor is open source server administration software.CVE-2026-54347 · Other software · froxlor · reported by GitHubHigh 8.7
Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and templates/Froxlor/table/table.html.twig renders the callback result with the raw filter. An authenticated customer with DNS editor access can store JavaScript-bearing content in a TXT record. When an administrator views the affected domain's DNS configuration, the payload executes automatically in the administrator's browser session, which can expose session data or perform privileged panel actions. This issue is fixed in version 2.3.8.
- Product
- froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Froxlor is open source server administration software.CVE-2026-52793 · Other software · froxlor · reported by GitHubHigh 8.1
Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAuth accepts an API key and secret for an administrator or customer account without checking type_2fa, validating a TOTP code, or invoking FroxlorTwoFactorAuth. The web interface requires a second factor for accounts with two-factor authentication enabled, but the API grants access after validating only the API credentials, expiration, API permission, and account status. An attacker who obtains an API key and secret for a protected account can call the available API functions without supplying the configured second factor, which can expose or modify customer data, domains, email and FTP accounts, databases, DNS records, and certificate material. This issue is fixed in version 2.3.7.
- Product
- froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading toCVE-2026-23938 · Other software · Zabbix · reported by security@zabbix.comLow 2.1
An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potentiaCVE-2026-23935 · Other software · Zabbix · reported by security@zabbix.comMedium 6.8
A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions.CVE-2026-75481 · Other software · skypilot-org · reported by VulnCheckHigh 8.7
SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces.
- Product
- skypilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password.CVE-2026-75103 · Other software · crawlab-team · reported by VulnCheckHigh 8.7
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.
- Product
- crawlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a runCVE-2026-16046 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API requests. Mattermost Advisory ID: MMSA-2026-00675
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the downlCVE-2026-16139 · Other software · Progress · reported by security@progress.comHigh 7.2
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.
- Product
- ShareFile Storage Zones Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinisCVE-2026-74889 · Other software · jahlives · reported by VulnCheckCritical 9.3
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.
- Product
- openssl_encrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 16, 2026All-in-One WP Migration and Backup: Does not restrict its migration import functionality to network administrators on multisite installationsCVE-2026-17533 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.
- Product
- All-in-One WP Migration and Backup
- Fixed in
- 7.108
- What to do
- Update All-in-One WP Migration and Backup to 7.108 or newer.
Aug 15, 2026In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish() In luo_file_unpCVE-2026-74369 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish() In luo_file_unpreserve_files() and luo_file_finish(), reorder module_put() and xa_erase() to ensure the file handler module remains pinned while its operations are being accessed. Specifically, luo_get_id() dereferences fh->ops->get_id, so the module reference must be held until after xa_erase() (which calls luo_get_id) completes. For luo_file_finish(), this requires moving the module_put() call out of the luo_file_finish_one() helper and into the main loop of luo_file_finish() itself.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 14, 2026ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary CVE-2026-73679 · Other software · ImpressCMS · reported by VulnCheckHigh 8.6
ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization, and the payload is triggered on every frontend page load through the preload event system.
- Product
- ImpressCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assiCVE-2026-19639 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comMedium 5.3
An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting CVE-2026-19631 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comMedium 6.9
A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrCVE-2026-16772 · Other software · Akaunting · reported by cret@cert.orgHigh 8.1
In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the `UpdateUser` job, which processes user-supplied role assignments via an unconditional `roles()->sync()` call without verifying whether the caller is authorized to manage roles. Users only require the default `update-auth-profile` permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by this issue. This vulnerability has been remediated in v3.2.0, commit 80ef6d3b154a.
- Product
- Akaunting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvokecyber.comvokecyber.com
Aug 14, 2026filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined denCVE-2026-72835 · Other software · filebrowser · reported by VulnCheckHigh 7.6
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no rule but resolve to the same filesystem object, gaining unauthorized access to denied files within their scope.
- Product
- filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 13, 2026Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administraCVE-2026-18741 · Other software · Froiden · reported by VulnCheckMedium 4.6
Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset. Attackers can store crafted HTML script tags in the application database that execute automatically in the browsers of any user who views the affected asset, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of authenticated users.
- Product
- Worksuite SaaS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordworksuite.bizvulncheck.com
Aug 13, 2026CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by sCVE-2026-67613 · Other software · usmannasir · reported by VulnCheckMedium 6.9
CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON request body, which is passed directly to open() in cloudManager.py without validation or allowlisting, enabling traversal to any file readable by the root-privileged CyberPanel process including credential files, SSL and SSH private keys, and JWT secret files.
- Product
- cyberpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberpanel.netgithub.com
Aug 13, 2026OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)CVE-2026-55987 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2High 8.1
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
- Product
- Gitea Open Source Git Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Aug 13, 2026A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMCVE-2026-73670 · Other software · Saurus · reported by VulnCheckHigh 8.6
A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the table_name GET or POST parameter. Attackers can perform table traversal, time-based blind, boolean-based blind, and error-based injection techniques to enumerate full database schema, access system tables such as information_schema, and chain the disclosure with secondary injection points to extract credential data.
- Product
- Saurus CMS Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.CVE-2026-73346 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 13, 2026Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection.CVE-2026-6464 · Other software · Postgresql · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007High 8.1
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. "COPY FROM" with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don't control. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
- Product
- Postgresql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea vCVE-2026-16241 · Other software · Postgresql · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Low 3.8
Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This typically yields a simple SIGSEGV, but rare cases might achieve client-specific integrity impact via the write. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
- Product
- Postgresql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms.CVE-2026-73616 · Other software · openremote · reported by VulnCheckHigh 7.1
OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.
- Product
- openremote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 13, 2026SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only CVE-2026-73610 · Other software · siyuan-note · reported by VulnCheckMedium 6.9
SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document identifiers, and expanded folder paths by calling the getLocalStorage endpoint.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 12, 2026A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protectioCVE-2026-0293 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 5.6
A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.
- Product
- Prisma Access Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.