Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,110 results · page 12 of 263
Sep 23, 2026ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking CompareCVE-2026-76979 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.7
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings CVE-2026-76978 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerabilitCVE-2026-75825 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.CVE-2026-19599 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Critical 9.9
ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an autheCVE-2026-84791 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.1
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an autheCVE-2026-84789 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.1
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenCVE-2026-84787 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.1
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.CVE-2026-15358 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.5
ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search ReCVE-2026-14913 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template InjecCVE-2026-12370 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.6
ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Event Booking Manager for WooCommerce: Does not restrict its event listing query to events the requesting user is permitted to readCVE-2026-91077 · WordPress plugins & themes · reported by WPScanLow 2.7
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them. This discloses private events and their content that WordPress withholds from users lacking the read_private_posts capability.
- Product
- Event Booking Manager for WooCommerce
- Fixed in
- 5.7.3
- What to do
- Update Event Booking Manager for WooCommerce to 5.7.3 or newer.
Sep 23, 2026Booking Manager: Does not verify that a request to modify a user's Booking Manager WordPress plugin before 2CVE-2026-91025 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.
- Product
- Booking Manager
- Fixed in
- 2.1.21
- What to do
- Update Booking Manager to 2.1.21 or newer.
Sep 23, 2026Booking Manager: Does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL queryCVE-2026-91024 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.
- Product
- Booking Manager
- Fixed in
- 2.1.21
- What to do
- Update Booking Manager to 2.1.21 or newer.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensCVE-2026-18176 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.4
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutualCVE-2026-18173 · Other software · IBM · reported by psirt@us.ibm.comLow 3.7
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML exCVE-2026-18172 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.4
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to allocation of resources without lCVE-2026-18170 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to allocation of resources without limits or throttling.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper validatCVE-2026-18169 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusteCVE-2026-18163 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-contCVE-2026-18162 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validCVE-2026-18161 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities CVE-2026-18156 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or preCVE-2026-18154 · Other software · IBM · reported by psirt@us.ibm.comHigh 8
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information and forge authenticatioCVE-2026-18153 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information and forge authentication tags due to the use of hard-coded cryptographic keys and initialization vectors.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of crypCVE-2026-18152 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.4
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of CVE-2026-18137 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensCVE-2026-18134 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal.CVE-2026-18133 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due toCVE-2026-18132 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser duCVE-2026-18131 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.2
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information due to insufficiently protected credenCVE-2026-18124 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information due to insufficiently protected credentials.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to the improper use of reflection wiCVE-2026-18123 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.6
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to the improper use of reflection with externally controlled input.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to read arbitrary files due to improper path canonicalization.CVE-2026-18114 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to read arbitrary files due to improper path canonicalization.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.CVE-2026-18095 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper authentication and miCVE-2026-18074 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.2
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper authentication and missing authorization.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due tCVE-2026-18066 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.9
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to execute arbitrary commands due to the inclusion of functionality frCVE-2026-17647 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to execute arbitrary commands due to the inclusion of functionality from an untrusted control sphere.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restricCVE-2026-17646 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to gain elevated privileges due to improper privilege mCVE-2026-17645 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.1
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to gain elevated privileges due to improper privilege management.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify transaCVE-2026-17644 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due tCVE-2026-17643 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusCVE-2026-17637 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to improper validation ofCVE-2026-17636 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTPCVE-2026-17635 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.1
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift 4.0.6.0 through 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.0.8.04.0.9.04.0.10.0CVE-2026-17620 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Financial Transaction Manager (FTM) for RedHat OpenShift 4.0.6.0 through 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.0.8.04.0.9.04.0.10.0 Interim Fix 064 IBM Financial Transaction Manager transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a CVE-2026-17618 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.3
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization.
- Product
- Financial Transaction Manager (FTM) for RedHat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.CVE-2026-82000 · Other software · Adobe · reported by AdobeCritical 9.6
Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- AEM 6.5 Forms JEE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.CVE-2026-81999 · Other software · Adobe · reported by AdobeHigh 8.7
Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- AEM 6.5 Forms JEE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of theCVE-2026-81995 · Other software · Adobe · reported by AdobeCritical 9.1
Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- AEM 6.5 Forms JEE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the cCVE-2026-75745 · Other software · Adobe · reported by AdobeCritical 10
Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- AEM 6.5 Forms JEE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.