Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,323 results · page 12 of 47
Feb 5, 2026Tanium addressed an incorrect default permissions vulnerability in Benchmark.CVE-2025-15341 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Benchmark.
- Product
- Benchmark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an incorrect default permissions vulnerability in Comply.CVE-2025-15340 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an incorrect default permissions vulnerability in Discover.CVE-2025-15339 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Discover.
- Product
- Discover
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an incorrect default permissions vulnerability in Partner Integration.CVE-2025-15338 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Partner Integration.
- Product
- Partner Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an incorrect default permissions vulnerability in Patch.CVE-2025-15337 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Patch.
- Product
- Patch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an incorrect default permissions vulnerability in Performance.CVE-2025-15336 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Performance.
- Product
- Performance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an information disclosure vulnerability in Threat Response.CVE-2025-15335 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.3
Tanium addressed an information disclosure vulnerability in Threat Response.
- Product
- Threat Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an information disclosure vulnerability in Threat Response.CVE-2025-15334 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.3
Tanium addressed an information disclosure vulnerability in Threat Response.
- Product
- Threat Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an information disclosure vulnerability in Threat Response.CVE-2025-15333 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.3
Tanium addressed an information disclosure vulnerability in Threat Response.
- Product
- Threat Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an information disclosure vulnerability in Threat Response.CVE-2025-15332 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.9
Tanium addressed an information disclosure vulnerability in Threat Response.
- Product
- Threat Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an uncontrolled resource consumption vulnerability in Connect.CVE-2025-15331 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.3
Tanium addressed an uncontrolled resource consumption vulnerability in Connect.
- Product
- Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an improper input validation vulnerability in Deploy.CVE-2025-15330 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 8.8
Tanium addressed an improper input validation vulnerability in Deploy.
- Product
- Deploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an information disclosure vulnerability in Threat Response.CVE-2025-15329 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.9
Tanium addressed an information disclosure vulnerability in Threat Response.
- Product
- Threat Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an improper link resolution before file access vulnerability in Enforce.CVE-2025-15328 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 5
Tanium addressed an improper link resolution before file access vulnerability in Enforce.
- Product
- Enforce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an improper access controls vulnerability in Deploy.CVE-2025-15327 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.3
Tanium addressed an improper access controls vulnerability in Deploy.
- Product
- Deploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an improper access controls vulnerability in Patch.CVE-2025-15326 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.3
Tanium addressed an improper access controls vulnerability in Patch.
- Product
- Patch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an improper input validation vulnerability in Discover.CVE-2025-15325 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.3
Tanium addressed an improper input validation vulnerability in Discover.
- Product
- Discover
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed a documentation issue in Engage.CVE-2025-15324 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.6
Tanium addressed a documentation issue in Engage.
- Product
- Engage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an improper certificate validation vulnerability in Tanium Appliance.CVE-2025-15323 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Low 3.7
Tanium addressed an improper certificate validation vulnerability in Tanium Appliance.
- Product
- Tanium Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an improper input validation vulnerability in Tanium Appliance.CVE-2025-15321 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Low 2.7
Tanium addressed an improper input validation vulnerability in Tanium Appliance.
- Product
- Tanium Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an improper output sanitization vulnerability in Tanium Appliance.CVE-2025-15312 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.6
Tanium addressed an improper output sanitization vulnerability in Tanium Appliance.
- Product
- Tanium Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance.CVE-2025-15311 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.8
Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance.
- Product
- Tanium Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an improper access controls vulnerability in Interact.CVE-2025-15289 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Low 3.1
Tanium addressed an improper access controls vulnerability in Interact.
- Product
- Interact
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-25585 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a vulnerability IccCmm.cpp:5793 when reading through index during ICC profile processing. The malformed ICC profile triggers improper array bounds validation in the color management module, resulting in an out-of-bounds read that can lead to memory disclosure or segmentation fault from accessing memory beyond the array boundary. This issue has been patched in version 2.3.1.3.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-25584 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a stack-buffer-overflow vulnerability in CIccTagFloatNum<>::GetValues(). This is triggered when processing a malformed ICC profile. The vulnerability allows an out-of-bounds write on the stack, potentially leading to memory corruption, information disclosure, or code execution when processing specially crafted ICC files. This issue has been patched in version 2.3.1.3.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-25583 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a heap buffer overflow vulnerability in CIccFileIO::Read8() when processing malformed ICC profile files via unchecked fread operation. This issue has been patched in version 2.3.1.3.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-25582 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a heap buffer overflow (read) vulnerability in CIccIO::WriteUInt16Float() when converting malformed XML to ICC profiles via iccFromXml tool. This issue has been patched in version 2.3.1.3.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-25503 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, type confusion allowed malformed ICC profiles to trigger undefined behavior when loading invalid icImageEncodingType values causing denial of service. This issue has been patched in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-25502 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, stack-based buffer overflow in icFixXml() function when processing malformed ICC profiles, allows potential arbitrary code execution through crafted NamedColor2 tags. This issue has been patched in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Copyscape Premium: Cross-Site Request Forgery (CSRF)CVE-2026-24966 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Copyscape Copyscape Premium copyscape-premium allows Cross Site Request Forgery.This issue affects Copyscape Premium: from n/a through <= 1.4.1.
- Product
- Copyscape Premium
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Copyscape Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 2, 2026A medium-severity vulnerability has been identified in BeyondTrust Privilege Management for Windows versions <=25.7.CVE-2026-1232 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891Medium 6.8
A medium-severity vulnerability has been identified in BeyondTrust Privilege Management for Windows versions <=25.7. Under certain conditions, a local authenticated user with elevated privileges may be able to bypass the product’s anti-tamper protections, which could allow access to protected application components and the ability to modify product configuration.
- Product
- Privilege management for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbeyondtrustcorp.service-now.combeyondtrust.com
Jan 29, 2026Tanium addressed an improper access controls vulnerability in Tanium Server.CVE-2025-15322 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.3
Tanium addressed an improper access controls vulnerability in Tanium Server.
- Product
- Tanium Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026Tanium addressed an improper access controls vulnerability in Interact.CVE-2025-15288 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Low 3.1
Tanium addressed an improper access controls vulnerability in Interact.
- Product
- Interact
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Tanium addressed a SQL injection vulnerability in Asset.CVE-2025-15344 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.3
Tanium addressed a SQL injection vulnerability in Asset.
- Product
- Asset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-24856 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Versions prior to 2.3.1.2 have an undefined behavior issue when floating-point NaN values are converted to unsigned short integer types during ICC profile XML parsing potentially corrupting memory structures and enabling arbitrary code execution. This vulnerability affects users of the iccDEV library who process ICC color profiles. ICC Profile Injection vulnerabilities arise when user-controllable input is incorporated into ICC profile data or other structured binary blobs in an unsafe manner. Version 2.3.1.2 contains a fix for the issue. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEdCVE-2025-13980 · Websites & servers · reported by mlhess@drupal.orgMedium 5.3
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEditor 5 Premium Features: from 0.0.0 before 1.2.10, from 1.3.0 before 1.3.6, from 1.4.0 before 1.4.3, from 1.5.0 before 1.5.1, from 1.6.0 before 1.6.4.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-24852 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.1
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, a heap buffer over-read when the strlen() function attempts to read a non-null-terminated buffer potentially leaking heap memory contents and causing application termination. This vulnerability affects users of the iccDEV library who process ICC color profiles. ICC Profile Injection vulnerabilities arise when user-controllable input is incorporated into ICC profile data or other structured binary blobs in an unsafe manner. Version 2.3.1.2 contains a fix for the issue. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026Tanium addressed an uncontrolled resource consumption vulnerability in Discover.CVE-2026-1224 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.9
Tanium addressed an uncontrolled resource consumption vulnerability in Discover.
- Product
- Discover
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026Tanium addressed an improper input validation vulnerability in Discover.CVE-2026-0925 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Low 2.7
Tanium addressed an improper input validation vulnerability in Discover.
- Product
- Discover
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24412 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have aHeap Buffer Overflow vulnerability in the CIccTagXmlSegmentedCurve::ToXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24411 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior in CIccTagXmlSegmentedCurve::ToXml(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24410 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24409 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Pointer Deference in CIccTagXmlFloatNum<>::ParseXml(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24407 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior in icSigCalcOp(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24406 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buffer Overflow vulnerability in CIccTagNamedColor2::SetSize(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24405 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buffer Overflow vulnerability in CIccMpeCalculator::Read(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24404 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, CIccXmlArrayType() contains a Null Pointer Dereference and Undefined Behavior vulnerability. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24403 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, an integer overflow vulnerability exists in icValidateStatus CIccProfile::CheckHeader() when user-controllable input is incorporated into profile data unsafely. Tampering with tag tables, offsets, or size fields can trigger parsing errors, memory corruption, or DoS, potentially enabling arbitrary Code Execution or bypassing application logic. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Premium Addons for Elementor: Missing AuthorizationCVE-2025-69300 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through <= 4.11.63.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.11.63
- What to do
- Affects up to 4.11.63. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2026HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in tCVE-2025-27380 · Other software · Altium · reported by 4760f414-e1ae-4ff1-bdad-c7a9c3538b79High 7.6
HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content.
- Product
- AES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.