Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,382 results · page 12 of 28
Feb 26, 2026A vulnerability was determined in berry-lang berry up to 1.1.0.CVE-2026-3285 · Other software · berry-lang · reported by VulDBLow 1.9
A vulnerability was determined in berry-lang berry up to 1.1.0. The affected element is the function scan_string of the file src/be_lexer.c. This manipulation causes out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Patch name: 7149c59a39ba44feca261b12f06089f265fec176. Applying a patch is the recommended action to fix this issue.
- Product
- berry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026A vulnerability was determined in Tenda F453 1.0.0.3.CVE-2026-3272 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda F453 1.0.0.3. Affected is the function fromDhcpListClient of the file /goform/DhcpListClient of the component httpd. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- F453
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026A vulnerability was determined in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1.CVE-2026-3264 · Other software · go2ismail · reported by VulDBLow 2.1
A vulnerability was determined in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. Affected by this issue is some unknown functionality of the component Administrative Interface. Executing a manipulation can lead to execution after redirect. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Free-CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026A vulnerability was determined in feiyuchuixue sz-boot-parent up to 1.3.2-beta.CVE-2026-3186 · Other software · feiyuchuixue · reported by VulDBLow 2.1
A vulnerability was determined in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unknown functionality of the file /api/admin/sys-user/reset/password/ of the component Password Reset Handler. This manipulation of the argument userId causes use of default password. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.3.3-beta addresses this issue. Patch name: aefaabfd7527188bfba3c8c9eee17c316d094802. It is suggested to upgrade the affected component. The project was informed beforehand and acted very professional: "We have added authorization validation to the password reset interface; now only users with the corresponding permissions are allowed to perform password resets."
- Product
- sz-boot-parent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026A vulnerability was determined in Tenda F453 1.0.0.3.CVE-2026-3165 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda F453 1.0.0.3. Impacted is the function fromSetWifiGusetBasic of the file /goform/AdvSetWrlsafeset of the component httpd. This manipulation of the argument mit_ssid causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- F453
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026A vulnerability was determined in exiftool up to 13.49 on macOS.CVE-2026-3102 · Other software · Exiftool Project · reported by VulDBLow 2.1
A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.
- Product
- Exiftool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026A vulnerability was determined in MuYuCMS 2.7.CVE-2025-15589 · Other software · Muyucms · reported by VulDBLow 2
A vulnerability was determined in MuYuCMS 2.7. Affected is the function delete_dir_file of the file application/admin/controller/Template.php of the component Template Management Page. This manipulation of the argument temn/tp causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Muyucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Feb 23, 2026A vulnerability was determined in DataLinkDC dinky up to 1.2.5.CVE-2026-3053 · Other software · DataLinkDC · reported by VulDBMedium 5.5
A vulnerability was determined in DataLinkDC dinky up to 1.2.5. This affects the function addInterceptors of the file dinky-admin/src/main/java/org/dinky/configure/AppConfig.java of the component OpenAPI Endpoint. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dinky
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability was determined in erzhongxmu JEEWMS up to 3.7.CVE-2026-3028 · Other software · erzhongxmu · reported by VulDBLow 2.1
A vulnerability was determined in erzhongxmu JEEWMS up to 3.7. This vulnerability affects the function doAdd of the file src/main/java/com/jeecg/demo/controller/JeecgListDemoController.java. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JEEWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114.CVE-2026-3015 · Other software · UTT · reported by VulDBHigh 7.4
A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/formPolicyRouteConf. Executing a manipulation of the argument GroupName can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- HiPER 810G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability was determined in a466350665 Smart-SSO up to 2.1.1.CVE-2026-2972 · Other software · a466350665 · reported by VulDBLow 1.9
A vulnerability was determined in a466350665 Smart-SSO up to 2.1.1. This affects the function Save of the file smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/admin/UserController.java of the component Role Edit Page. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart-SSO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A vulnerability was determined in Jinher OA C6 up to 20260210.CVE-2026-2963 · Other software · Jinher · reported by VulDBLow 2.1
A vulnerability was determined in Jinher OA C6 up to 20260210. This issue affects some unknown processing of the file /C6/Jhsoft.Web.officesupply/OfficeSupplyTypeRight.aspx. This manipulation of the argument id/offsnum causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to install a patch to address this issue. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA C6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A vulnerability was determined in Zaher1307 tiny_web_server up to 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b.CVE-2026-2940 · Other software · Zaher1307 · reported by VulDBMedium 5.5
A vulnerability was determined in Zaher1307 tiny_web_server up to 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b. This affects the function tiny_web_server/tiny.c of the file tiny_web_server/tiny.c of the component URL Handler. This manipulation causes out-of-bounds write. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- tiny_web_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A vulnerability was determined in D-Link DWR-M960 1.01.07.CVE-2026-2929 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_453140 of the file /boafrm/formWlAc of the component Wireless Access Control Endpoint. This manipulation of the argument submit-url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026A vulnerability was determined in libvips up to 8.19.0.CVE-2026-2913 · Other software · Libvips · reported by VulDBLow 1.1
A vulnerability was determined in libvips up to 8.19.0. The affected element is the function vips_source_read_to_memory of the file libvips/iofuncs/source.c. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. Patch name: a56feecbe9ed66521d9647ec9fbcd2546eccd7ee. Applying a patch is the recommended action to fix this issue. The confirmation of the bugfix mentions: "[T]he impact of this is negligible, since this only affects custom seekable sources larger than 4 GiB (and the crash occurs in user code rather than libvips itself)."
- Product
- Libvips
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026A vulnerability was determined in UTT HiPER 810G 1.7.7-171114.CVE-2026-2904 · Other software · UTT · reported by VulDBHigh 7.4
A vulnerability was determined in UTT HiPER 810G 1.7.7-171114. This affects the function strcpy of the file /goform/ConfigExceptAli. Executing a manipulation can lead to buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- HiPER 810G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026A vulnerability was determined in D-Link DWR-M960 1.01.07.CVE-2026-2883 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_427D74 of the file /boafrm/formIpQoS. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026A vulnerability was determined in Tenda A18 15.13.07.13.CVE-2026-2876 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda A18 15.13.07.13. This affects the function parse_macfilter_rule of the file /goform/setBlackRule. This manipulation of the argument deviceList causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- A18
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026A vulnerability was determined in D-Link DWR-M960 1.01.07.CVE-2026-2857 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was determined in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_423E00 of the file /boafrm/formPortFw of the component Port Forwarding Configuration Endpoint. This manipulation of the argument submit-url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4.CVE-2026-2851 · Other software · yeqifu · reported by VulDBLow 2.1
A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This vulnerability affects the function addInport/updateInport/deleteInport of the file dataset\repos\warehouse\src\main\java\com\yeqifu\bus\controller\InportController.java of the component Inport Endpoint. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- warehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026A vulnerability was determined in CoCoTeaNet CyreneAdmin up to 1.3.0.CVE-2026-2693 · Other software · CoCoTeaNet · reported by VulDBLow 2.1
A vulnerability was determined in CoCoTeaNet CyreneAdmin up to 1.3.0. This vulnerability affects unknown code of the file /api/system/dashboard/getCount of the component System Info Endpoint. Executing a manipulation can lead to improper authorization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CyreneAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532).CVE-2026-2684 · Other software · Tsinghua Unigroup · reported by VulDBMedium 5.5
A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The impacted element is an unknown function of the file /Archive/ErecordManage/uploadFile.html. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Electronic Archives System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026A vulnerability was determined in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206.CVE-2026-2669 · Other software · Rongzhitong · reported by VulDBMedium 5.5
A vulnerability was determined in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This impacts an unknown function of the file /dm/dispatch/user/delete of the component User Handler. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Visual Integrated Command and Dispatch Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026A vulnerability was determined in Squirrel up to 3.2.CVE-2026-2659 · Other software · Squirrel-lang · reported by VulDBLow 1.9
A vulnerability was determined in Squirrel up to 3.2. Affected by this vulnerability is the function SQFuncState::PopTarget of the file src/squirrel/squirrel/sqfuncstate.cpp. Executing a manipulation of the argument _target_stack can lead to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Squirrel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026A vulnerability was determined in Beetel 777VR1 up to 01.00.09.CVE-2026-2618 · Other software · Beetel · reported by VulDBLow 2.9
A vulnerability was determined in Beetel 777VR1 up to 01.00.09. This impacts an unknown function of the component SSH Service. This manipulation causes risky cryptographic algorithm. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 777VR1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Feb 16, 2026A vulnerability was determined in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533.CVE-2026-2562 · Other software · JingDong · reported by VulDBLow 2.1
A vulnerability was determined in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This impacts the function cast_streen of the file /jdcapi of the component jdcweb_rpc. Executing a manipulation of the argument File can lead to Remote Privilege Escalation. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JD Cloud Box AX6600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026A vulnerability was determined in ZenTao up to 21.7.8.CVE-2026-2551 · Other software · Zentao · reported by VulDBLow 2.1
A vulnerability was determined in ZenTao up to 21.7.8. Affected by this vulnerability is the function delete of the file editor/control.php of the component Backup Handler. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026A vulnerability was determined in opencc JFlow up to 20260129.CVE-2026-2536 · Other software · opencc · reported by VulDBLow 2.1
A vulnerability was determined in opencc JFlow up to 20260129. This affects the function Imp_Done of the file src/main/java/bp/wf/httphandler/WF_Admin_AttrFlow.java of the component Workflow Engine. This manipulation of the argument File causes xml external entity reference. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- JFlow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2026A vulnerability was determined in Wavlink WL-WN579A3 up to 20210219.CVE-2026-2527 · Other software · Wavlink · reported by VulDBLow 2.1
A vulnerability was determined in Wavlink WL-WN579A3 up to 20210219. Affected is an unknown function of the file /cgi-bin/login.cgi. Executing a manipulation of the argument key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WL-WN579A3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.CVE-2026-25609 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 5.3
Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026A vulnerability was determined in janet-lang janet up to 1.40.1.CVE-2026-2242 · Other software · janet-lang · reported by VulDBLow 1.9
A vulnerability was determined in janet-lang janet up to 1.40.1. This impacts the function janetc_if of the file src/core/specials.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called c43e06672cd9dacf2122c99f362120a17c34b391. It is advisable to implement a patch to correct this issue.
- Product
- janet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026A vulnerability was determined in D-Link DCS-933L up to 1.14.11.CVE-2026-2218 · Network & remote access · D-Link · reported by VulDBLow 2.1
A vulnerability was determined in D-Link DCS-933L up to 1.14.11. This affects an unknown function of the file /setSystemAdmin of the component alphapd. This manipulation of the argument AdminID causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DCS-933L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2026A vulnerability was determined in UTT 进取 521G 3.1.1-190816.CVE-2026-2188 · Other software · UTT · reported by VulDBHigh 7.3
A vulnerability was determined in UTT 进取 521G 3.1.1-190816. The impacted element is the function sub_446B18 of the file /goform/formPdbUpConfig. Executing a manipulation of the argument policyNames can lead to os command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- 进取 521G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2026A vulnerability was determined in mwielgoszewski doorman up to 0.6.CVE-2026-2153 · Other software · mwielgoszewski · reported by VulDBLow 2.1
A vulnerability was determined in mwielgoszewski doorman up to 0.6. This issue affects the function is_safe_url of the file doorman/users/views.py. Executing a manipulation of the argument Next can lead to open redirect. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- doorman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Feb 8, 2026A vulnerability was determined in Tenda TX9 up to 22.03.02.10_multi.CVE-2026-2139 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda TX9 up to 22.03.02.10_multi. Affected by this vulnerability is the function sub_432580 of the file /goform/fast_setting_wifi_set. This manipulation of the argument ssid causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- TX9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2026A vulnerability was determined in BurtTheCoder mcp-maigret up to 1.0.12.CVE-2026-2130 · Other software · BurtTheCoder · reported by VulDBMedium 5.3
A vulnerability was determined in BurtTheCoder mcp-maigret up to 1.0.12. This affects an unknown part of the file src/index.ts of the component search_username. Executing a manipulation of the argument Username can lead to command injection. The attack may be launched remotely. Upgrading to version 1.0.13 is able to mitigate this issue. This patch is called b1ae073c4b3e789ab8de36dc6ca8111ae9399e7a. Upgrading the affected component is advised.
- Product
- mcp-maigret
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2026A vulnerability was determined in UTT HiPER 810 1.7.4-141218.CVE-2026-2118 · Other software · UTT · reported by VulDBHigh 7.3
A vulnerability was determined in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_4407D4 of the file /goform/formReleaseConnect of the component rehttpd. Executing a manipulation of the argument Isp_Name can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- HiPER 810
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2026A vulnerability was determined in jsbroks COCO Annotator up to 0.11.1.CVE-2026-2108 · Other software · jsbroks · reported by VulDBMedium 5.5
A vulnerability was determined in jsbroks COCO Annotator up to 0.11.1. This impacts an unknown function of the file /api/info/long_task of the component Endpoint. This manipulation causes denial of service. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- COCO Annotator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2026A vulnerability was determined in D-Link DIR-823X 250416.CVE-2026-2081 · Network & remote access · D-Link · reported by VulDBLow 2
A vulnerability was determined in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_password. This manipulation of the argument http_passwd causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DIR-823X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026A vulnerability was determined in D-Link DIR-823X 250416.CVE-2026-2061 · Network & remote access · D-Link · reported by VulDBLow 2
A vulnerability was determined in D-Link DIR-823X 250416. Affected by this issue is the function sub_424D20 of the file /goform/set_ipv6. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DIR-823X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026A vulnerability was determined in Free5GC up to 4.1.0.CVE-2026-1973 · Other software · Free5gc · reported by VulDBMedium 5.5
A vulnerability was determined in Free5GC up to 4.1.0. The impacted element is the function establishPfcpSession of the component SMF. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. It is best practice to apply a patch to resolve this issue.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026A vulnerability was determined in WeKan up to 8.20.CVE-2026-1964 · Other software · Wekan Project · reported by VulDBMedium 5.3
A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endpoint. This manipulation causes improper access controls. Remote exploitation of the attack is possible. Upgrading to version 8.21 will fix this issue. Patch name: 545566f5663545d16174e0f2399f231aa693ab6e. It is advisable to upgrade the affected component.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026A vulnerability was determined in WeKan up to 8.20.CVE-2026-1898 · Other software · Wekan Project · reported by VulDBMedium 5.3
A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to mitigate this issue. Patch name: 146905a459106b5d00b4f09453a6554255e6965a. You should upgrade the affected component.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026In the Linux kernel, the following vulnerability has been resolved: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag ThCVE-2026-23105 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag This is more of a preventive patch to make the code more consistent and to prevent possible exploits that employ child qlen manipulations on qfq. use cl_is_active instead of relying on the child qdisc's qlen to determine class activation.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 1, 2026A vulnerability was determined in EFM ipTIME A8004T 14.18.2.CVE-2026-1741 · Other software · EFM · reported by VulDBMedium 6.6
A vulnerability was determined in EFM ipTIME A8004T 14.18.2. Affected is the function httpcon_check_session_url of the file /sess-bin/d.cgi of the component Debug Interface. This manipulation of the argument cmd causes backdoor. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ipTIME A8004T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer rCVE-2026-25210 · Other software · libexpat project · reported by MITREMedium 6.9
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.
- Product
- libexpat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026A vulnerability was determined in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116.CVE-2026-1599 · Other software · Bdtask · reported by VulDBLow 2.1
A vulnerability was determined in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The affected element is an unknown function of the file /hungry/placeorder of the component Checkout. Executing a manipulation of the argument orggrandTotal/vat/service_charge/grandtotal can lead to business logic errors. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Bhojon All-In-One Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026A vulnerability was determined in D-Link DIR-615 4.10.CVE-2026-1506 · Network & remote access · D-Link · reported by VulDBHigh 7.3
A vulnerability was determined in D-Link DIR-615 4.10. Impacted is an unknown function of the file /adv_mac_filter.php of the component MAC Filter Configuration. This manipulation of the argument mac causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-615
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentagonal-time-3a7.notion.sitevuldb.com
Jan 25, 2026A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12.CVE-2026-1414 · Other software · Sangfor · reported by VulDBLow 2.1
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the file /equipment/get_Information of the component HTTP POST Request Handler. Executing a manipulation of the argument fortEquipmentIp can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Operation and Maintenance Security Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2026A vulnerability was determined in lcg0124 BootDo up to 5ccd963c74058036b466e038cff37de4056c1600.CVE-2026-1406 · Other software · lcg0124 · reported by VulDBLow 2
A vulnerability was determined in lcg0124 BootDo up to 5ccd963c74058036b466e038cff37de4056c1600. Affected by this vulnerability is the function redirectToLogin of the file AccessControlFilter.java of the component Host Header Handler. This manipulation of the argument Hostname causes open redirect. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available.
- Product
- BootDo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.