Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,053 results · page 12 of 82
Jun 15, 2026Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.CVE-2026-49775 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.
- Affected
- up to 2.11.28
- What to do
- Affects up to 2.11.28. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.CVE-2026-48868 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.
- Affected
- up to 5.2.9
- What to do
- Affects up to 5.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.CVE-2026-40792 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.CVE-2026-39470 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting inCVE-2016-20077 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in decode.php. Attackers can supply base64-encoded file paths in the 'id' parameter to the decode.php endpoint to retrieve sensitive files like wp-config.php containing database credentials and configuration data.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordfr.wordpress.orgexploit-db.com
Jun 11, 2026YITH WooCommerce Product Slider Carousel: Cross-Site request forgery (CSRF)CVE-2022-44630 · WordPress plugins & themes · reported by PatchstackMedium 4.6
Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Request Forgery. This issue affects YITH WooCommerce Product Slider Carousel: from n/a through 1.16.0.
- Product
- YITH WooCommerce Product Slider Carousel
- Affected
- up to 1.16.0
- What to do
- Affects up to 1.16.0. Update YITH WooCommerce Product Slider Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 11, 2026WP Logo Showcase Responsive Slider and Carousel: Authorization bypass through User-Controlled keyCVE-2023-40200 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization bypass through User-Controlled key vulnerability in Essential Plugin WP Logo Showcase Responsive Slider and Carousel allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Logo Showcase Responsive Slider and Carousel: from n/a through 3.6.
- Product
- WP Logo Showcase Responsive Slider and Carousel
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update WP Logo Showcase Responsive Slider and Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2026An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.CVE-2026-36727 · Other software · reported by MITRECritical 9.1
An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026An arbitrary file deletion vulnerability in the /api/delete-temp-license/{file} endpoint of bookcars v8.3 allows unauthenticated attackers to delete arbitrary fCVE-2026-36726 · Other software · reported by MITREMedium 5.3
An arbitrary file deletion vulnerability in the /api/delete-temp-license/{file} endpoint of bookcars v8.3 allows unauthenticated attackers to delete arbitrary files via supplying directory traversal sequences.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows authenticated attackers to leverage directory traversal sequCVE-2026-36723 · Other software · reported by MITREHigh 8.8
An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows authenticated attackers to leverage directory traversal sequences to move arbitrary files from temporary storage to arbitrary locations on the server filesystem. This enables unauthorized access to sensitive files, the overwriting of critical application files, and remote code execution (RCE).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026An authenticated arbitrary file upload vulnerability in the /api/create-car-image component of bookcars v8.3 allows attackers to execute arbitrary code via uploCVE-2026-36722 · Other software · reported by MITREMedium 5.4
An authenticated arbitrary file upload vulnerability in the /api/create-car-image component of bookcars v8.3 allows attackers to execute arbitrary code via uploading a crafted file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authentication via a forged JWT tCVE-2026-36721 · Other software · reported by MITRECritical 9.8
A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Insecure permissions in bookcars v8.3 allows authenticated attackers to escalate privileges from user to admin via modifying their user type.CVE-2026-36720 · Other software · reported by MITREHigh 8.1
Insecure permissions in bookcars v8.3 allows authenticated attackers to escalate privileges from user to admin via modifying their user type.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Hermes WebUI before version 0.51.303 contains a time-of-check time-of-use (TOCTOU) race condition vulnerability in the git_discard function within api/workspaceCVE-2026-49958 · Other software · nesquena · reported by VulnCheckMedium 4.3
Hermes WebUI before version 0.51.303 contains a time-of-check time-of-use (TOCTOU) race condition vulnerability in the git_discard function within api/workspace_git.py that allows attackers to delete files outside the configured workspace boundary by replacing a validated path component with a symlink after validation but before deletion. Attackers can substitute a workspace-controlled path component with a symlink pointing to an external directory between the safe_resolve_ws() validation step and the subsequent Path.unlink() or shutil.rmtree() deletion call, causing the delete operation to follow the symlink and remove arbitrary files outside the workspace.
- Product
- hermes-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not hCVE-2026-11764 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 3.6
When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift card secret are shown. Therefore, it allows circumventing a permission boundary.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that allows unauthenticated attackers to manipulate daCVE-2017-20243 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the space_id parameter. Attackers can send GET requests to the booking-page endpoint with malicious space_id values using AND SLEEP() payloads to extract sensitive database information.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordcodecanyon.netexploit-db.com
Jun 9, 2026kk blog card: Stored Cross-Site ScriptingCVE-2026-8895 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The kk blog card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blog-card' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on the shortcode's 'href' and 'type' attributes, which are concatenated directly into HTML attribute contexts in the shortcode callback registered in kk-blog-card-shortcode.php. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- kk blog card
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update kk blog card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2026RomanCart Ecommerce: Stored Cross-Site ScriptingCVE-2026-8880 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RomanCart Ecommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blclass' attribute (and other attributes) of the romancart_button shortcode in versions up to, and including, 2.0.8. This is due to insufficient input sanitization and output escaping on user supplied attributes within the romancart_button_shortcode() function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- RomanCart Ecommerce
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update RomanCart Ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 8, 2026Recipe Card Blocks Lite: Stored Cross-Site ScriptingCVE-2026-3011 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the recipe block's 'summary' and 'notes' attributes in all versions up to, and including, 3.4.13. This is due to the 'WPZOOM_Helpers::deserialize_block_attributes' method converting unicode-encoded sequences back into HTML characters after sanitization has already been applied. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses the published post or the print view of an injected recipe.
- Product
- Recipe Card Blocks Lite
- Affected
- up to 3.4.13
- What to do
- Affects up to 3.4.13. Update Recipe Card Blocks Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 4, 2026Incorrect security UI in Tab Hover Cards in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name.CVE-2026-11227 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Incorrect security UI in Tab Hover Cards in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Jun 4, 2026Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by manipulating the ck_config CVE-2019-25728 · Other software · care2x · reported by VulnCheckHigh 8.8
Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by manipulating the ck_config cookie parameter. Attackers can inject malicious SQL through the ck_config cookie in multiple endpoints including login.php, indexframe.php, and various module files to extract sensitive database information without authentication.
- Product
- Care2x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Jun 3, 2026OMICARD EDM developed by ITPison has a Insecure Direct Object Reference vulnerability, allowing unauthenticated remote attackers to modify a specific parameter CVE-2026-10597 · Other software · ITPison · reported by twcert@cert.org.twMedium 6.9
OMICARD EDM developed by ITPison has a Insecure Direct Object Reference vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to obtain user's email address.
- Product
- OMICARD EDM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 2, 2026Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (with VG4.2 partially affected) contain a nCVE-2022-4992 · Other software · Dräger · reported by VulnCheckHigh 8.8
Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (with VG4.2 partially affected) contain a network message handling vulnerability that allows remote attackers to inject spoofed or tampered data and cause denial-of-service conditions. Attackers can compromise network communications to modify device settings such as alarm states or alarm limits, or overwhelm the system with excessive network traffic causing the Cockpit or M540 to reboot and lose network functionality.
- Product
- Infinity Acute Care System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstatic.draeger.comvulncheck.com
Jun 2, 2026Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code execution vulnerability through a depreCVE-2026-0611 · Other software · Spacelabs Healthcare · reported by VulnCheckCritical 9.2
Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code execution vulnerability through a deprecated .NET Remoting HTTP channel exposed on port 8989 that allows attackers to perform arbitrary file read and write operations by supplying valid .NET URI endpoints. Attackers can write ASPX webshells to the IIS wwwroot directory to achieve unauthenticated remote code execution on the system. Port 8989 is not exposed in a default Sentinel installation; exploitation requires that the .NET Remoting port has been explicitly made network-accessible through deliberate configuration or network policy changes.
- Product
- Sentinel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspacelabshealthcare.comspacelabshealthcare.com
Jun 2, 2026Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software versions VG4.1.1, VG4.0.3, and lower contain network message haCVE-2019-25719 · Other software · Dräger · reported by VulnCheckHigh 8.8
Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software versions VG4.1.1, VG4.0.3, and lower contain network message handling vulnerabilities that allow network-adjacent attackers to spoof or tamper with data and cause denial-of-service conditions. Attackers with access to an enabled Infinity network port or physical proximity to a wireless access point can modify device settings such as alarm states or alarm limits, and overwhelm the system with incoming data causing the device to reboot and lose network functionality.
- Product
- Infinity Acute Care System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstatic.draeger.comvulncheck.com
Jun 2, 2026Tiled Gallery Carousel Without JetPack: Stored cross-site scriptingCVE-2026-5191 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Tiled Gallery Carousel Without JetPack plugin for WordPress is vulnerable to stored cross-site scripting via the 'data-image-title' parameter in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Tiled Gallery Carousel Without JetPack
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Tiled Gallery Carousel Without JetPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 2, 2026Easy Cart: Stored Cross-Site ScriptingCVE-2026-4080 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_to_cart' shortcode in all versions up to and including 1.8. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, the ectp_add_to_cart() function uses sanitize_text_field() on shortcode attributes like 'itemid', 'product_name', 'product_desc', 'product_qty', and 'price' before inserting them into double-quoted HTML attributes. While sanitize_text_field() strips HTML tags, it does not escape double quote characters, allowing an attacker to break out of the HTML attribute context and inject arbitrary event handlers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Easy Cart
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Easy Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 1, 2026In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to a managed device duCVE-2025-26418 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to a managed device due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026ZeusCart 4.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of victims by crafting maliciouCVE-2018-25435 · Other software · zeuscart · reported by VulnCheckMedium 6.9
ZeusCart 4.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of victims by crafting malicious requests. Attackers can deactivate customer accounts via the admin interface by tricking users into visiting attacker-controlled pages that submit requests to the regstatus endpoint with action=deny parameters.
- Product
- ZeusCart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that alloCVE-2026-40510 · Other software · OpenSC · reported by VulnCheckLow 1
OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.
- Product
- OpenSC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Improper access control in the MQTT broker allows wildcard topic subscriptions, exposing all MQTT traffic to unauthorized actors.CVE-2026-49198 · Other software · Acer · reported by 8fc372e3-d9c5-46e4-9410-38469745c639High 8.3
Improper access control in the MQTT broker allows wildcard topic subscriptions, exposing all MQTT traffic to unauthorized actors.
- Product
- Predator Connect W6x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Automotive Car Dealership Business: Stored Cross-Site ScriptingCVE-2025-14042 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Project Details' custom field in Portfolio Items in all versions up to, and including, 13.4.1. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the 'project_details' custom field. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Automotive Car Dealership Business
- Affected
- up to 13.4.1
- What to do
- Affects up to 13.4.1. Update Automotive Car Dealership Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
May 28, 2026MeshCore Card provides MeshCore Lovelace card for Home Assistant.CVE-2026-45323 · Other software · jpettitt · reported by GitHubCritical 9.6
MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.
- Product
- meshcore-card
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026mapfish-print is a component of MapFish for printing templated cartographic maps.CVE-2026-44672 · Other software · mapfish · reported by GitHubCritical 9.3
mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3.
- Product
- mapfish-print
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.CVE-2026-8915 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comHigh 8.8
Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 36f5fb58366a67b713c02f6fd985e924fcc09e31.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026In the Linux kernel, the following vulnerability has been resolved: zram: do not forget to endio for partial discard requests As reported by Qu Wenruo and AviCVE-2026-46089 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: zram: do not forget to endio for partial discard requests As reported by Qu Wenruo and Avinesh Kumar, the following getconf PAGESIZE 65536 blkdiscard -p 4k /dev/zram0 takes literally forever to complete. zram doesn't support partial discards and just returns immediately w/o doing any discard work in such cases. The problem is that we forget to endio on our way out, so blkdiscard sleeps forever in submit_bio_wait(). Fix this by jumping to end_bio label, which does bio_endio().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 27, 2026In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix usb_dev refcount leak on probe failure create_card() takes a reference onCVE-2026-46048 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix usb_dev refcount leak on probe failure create_card() takes a reference on the USB device with usb_get_dev() and stores the matching usb_put_dev() in card_free(), which is installed as the snd_card's ->private_free destructor. However, ->private_free is only assigned near the end of init_card(), after several failure points (usb_set_interface(), EP type checks, usb_submit_urb(), the EP1_CMD_GET_DEVICE_INFO exchange, and its timeout). When any of those fail, init_card() returns an error to snd_probe(), which calls snd_card_free(card). Because ->private_free is still NULL, card_free() never runs, the usb_get_dev() reference is not dropped, and the struct usb_device leaks along with its descriptor allocations and device_private. syzbot reproduces this with a malformed UAC3 device whose only valid altsetting is 0; init_card()'s usb_set_interface(usb_dev, 0, 1) call fails with -EIO and triggers the leak. Move the ->private_free assignment into create_card(), immediately after usb_get_dev(), so that every error path reaching snd_card_free() balances the reference. card_free()'s callees (snd_usb_caiaq
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 27, 2026In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Handle probe errors properly The probe procedure of setup_card() in caiaq driCVE-2026-46004 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Handle probe errors properly The probe procedure of setup_card() in caiaq driver doesn't treat the error cases gracefully, e.g. the error from snd_card_register() calls snd_card_free() but continues. This would lead to a UAF for the further calls like snd_usb_caiaq_control_init(), as Berk suggested in another patch in the link below. However, the problem is not only that; in general, this function drops the all error handlings (as it's a void function) although its caller can propagate an error to snd_probe(), which eventually calls snd_card_free() as a proper error path. That said, we should treat each error case in setup_card(), and just return the error code promptly, which is then handled later as a fatal error in snd_probe(). This patch achieves it by changing the setup_card() to return an error code. Also, the superfluous snd_card_free() call is removed, too. Note that card->private_free can be set still safely at returning an error. All called functions in card_free() have checks of the unassigned resources or NULL checks.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 27, 2026KiviCare: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-42735 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Password Recovery Exploitation.This issue affects KiviCare: from n/a through <= 4.3.0.
- Product
- KiviCare
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update KiviCare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026Splide Carousel Block: Stored Cross-Site ScriptingCVE-2026-9022 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Splide Carousel Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'url' Block Attribute in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload must be published before it executes for site visitors, which requires an editor or administrator to approve and publish the contributor's post.
- Product
- Splide Carousel Block
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Splide Carousel Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 27, 2026Attackers carefully craft malicious scripts, such as JavaScript, and inject them into target systems; when other users access pages containing such malicious coCVE-2026-48999 · Other software · ZTE · reported by psirt@zte.com.cnMedium 5.7
Attackers carefully craft malicious scripts, such as JavaScript, and inject them into target systems; when other users access pages containing such malicious content, the scripts are automatically loaded and executed in the victim's browser.Attackers can thereby steal user cookies, hijack session privileges, and tamper with page content.Since the malicious code is stored within the system, the attack scope is broad and the concealment is strong, making it frequently employed for data theft attacks.
- Product
- ZXUniPOS NDS-LTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Traccar is an open source GPS tracking system.CVE-2026-44314 · Other software · traccar · reported by GitHubMedium 5.3
Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.Permission(User.class, getUserId(), Device.class) and then immediately streams the uploaded body into mediaManager.createFileStream(...). Unlike the generic mutation path in BaseObjectResource.update and the explicit device mutation handler updateAccumulators, this route never invokes permissionsService.checkEdit(getUserId(), Device.class, false, false). The skipped guard is exactly where Traccar enforces readonly and deviceReadonly restrictions for non-admin users. An unauthorized user can replace a device’s stored image file under the server media directory. This allows modification of UI-visible device media and any downstream workflows that rely on the persisted image, despite other device update paths correctly rejecting the same identity. This vulnerability is fixed in 6.13.0.
- Product
- traccar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026Sunshine Photo Cart: Missing AuthorizationCVE-2026-42776 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sunshine Photo Cart: from n/a through 3.6.7.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.6.7
- What to do
- Affects up to 3.6.7. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 25, 2026NanoCare: Missing AuthorizationCVE-2026-32389 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Linethemes NanoCare allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects NanoCare: from n/a before 1.2.2.
- Product
- NanoCare
- Fixed in
- 1.2.2
- What to do
- Update NanoCare to 1.2.2 or newer.
May 25, 2026Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of anCVE-2026-5223 · Other software · Rust Project · reported by 986d4109-89ea-491f-99fd-a8e4803919bdMedium 6.5
Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.
- Product
- Cargo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.rust-lang.orggithub.com
May 25, 2026Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol.CVE-2026-5222 · Other software · Rust · reported by 986d4109-89ea-491f-99fd-a8e4803919bdLow 2.3
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.
- Product
- Cargo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.rust-lang.orggithub.com
May 25, 2026A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor.CVE-2026-9490 · Other software · Acer · reported by 8fc372e3-d9c5-46e4-9410-38469745c639Medium 6.8
A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerability allows an authenticated local user to connect and send a specially crafted message (message type 0x03) to the pipe, causing the service to crash with exit code 1067 (ERROR_PROCESS_ABORTED). To mitigate this potential local service disruption, Acer requires users to update the software to the latest version.
- Product
- Care Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially droppinCVE-2026-39828 · Other software · golang.org/x/crypto · reported by security@golang.orgMedium 6.3
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.
- Product
- golang.org/x/crypto/ssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026Gift Cards For WooCommerce Pro: Unrestricted Upload of File with Dangerous TypeCVE-2026-45444 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6.
- Product
- Gift Cards For WooCommerce Pro
- Affected
- up to 4.2.6
- What to do
- Affects up to 4.2.6. Update Gift Cards For WooCommerce Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 20, 2026SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider') oCVE-2026-9065 · WordPress plugins & themes · reported by vulnreport@tenable.comCritical 9.3
SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider') on the REST API endpoint '/surecart/v1/integrations/{id}'. The root cause is a flawed escaping bypass in the query builder ('wp-query-builder'). Values passed to the 'where()' method are only sanitized via '$wpdb->prepare()' when they do **not** contain a dot ('.') or the WordPress table prefix ('wp_'). By including a dot anywhere in the payload, an attacker completely bypasses the escaping logic and injects arbitrary SQL into the 'WHERE' clause, allowing full UNION-based extraction of the database.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.