Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

8,247 results · page 14 of 165

Jul 14, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security featurCVE-2026-45496 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Product
Visual Studio Code
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Jul 14, 2026A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4.0 through 7.CVE-2026-59839 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.5
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.8.0, FortiPAM 1.7.0 through 1.7.2, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy 7.4 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Product
FortiProxy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.fortinet.com cert-portal.siemens.com
Jul 14, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OpenMeetings.CVE-2026-49488 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OpenMeetings. This issue affects Apache OpenMeetings: from 5.0.0 before 9.1.0. An attacker with moderator rights in any room can read arbitrary files accessible to the OS account running the OM server, including credentials and secrets, via a crafted download request. Users are recommended to upgrade to version 9.1.0, which fixes the issue.
Product
Apache OpenMeetings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Jul 13, 2026Forminator: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-57815 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Path Traversal.This issue affects Forminator: from n/a through <= 1.55.0.2.
Product
Forminator
Affected
up to 1.55.0.2
What to do
Affects up to 1.55.0.2. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Membership For WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-57709 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Path Traversal.This issue affects Membership For WooCommerce: from n/a through <= 3.1.0.
Product
Membership For WooCommerce
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Membership For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Simple Business Directory Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57707 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows SQL Injection.This issue affects Simple Business Directory Pro: from n/a through <= 15.9.4.
Product
Simple Business Directory Pro
Affected
up to 15.9.4
What to do
Affects up to 15.9.4. Update Simple Business Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026SureDash: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-57401 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This issue affects SureDash: from n/a through <= 1.8.0.
Product
SureDash
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Groundhogg: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-57389 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adrian Tobey Groundhogg groundhogg allows Path Traversal.This issue affects Groundhogg: from n/a through <= 4.4.1.
Product
Groundhogg
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 11, 2026W3 Total Cache: Directory TraversalCVE-2026-9282 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires enabling manual minify mode and supplying a manual-format minify filename so that the hash is empty and the f_array[] entries are not overwritten before reaching setupSources().
Product
W3 Total Cache
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update W3 Total Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.CVE-2026-40005 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions with unsafe API. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Product
Apache IoTDB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Jul 10, 2026ARMember: Directory TraversalCVE-2026-15302 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files (e.g., CSS) to directories outside the 'wp-content/uploads/armember' directory.
Product
ARMember
Affected
up to 4.0.27
What to do
Affects up to 4.0.27. Update ARMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 10, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Blind SQL InjectionCVE-2026-15290 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to blind SQL Injection via the search parameter in all versions up to, and including, 2.10.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability was partially patched in version 2.9.2 when initially addressing CVE-2025-0308.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.10.1
What to do
Affects up to 2.10.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write.CVE-2026-39245 · Other software · Decompress Project · reported by MITREMedium 6.2
decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function (index.js line 29) and the extraction path validation (index.js line 106) use String.indexOf() to verify the resolved path is within the output directory: realDestinationDir.indexOf(realOutputPath) !== 0. This check is flawed because it does not enforce a path separator boundary. For example, "/tmp/app_config".indexOf("/tmp/app") returns 0, incorrectly passing the check even though /tmp/app_config is outside /tmp/app. Combined with the unvalidated symlink creation in the same package, an attacker can write arbitrary files to directories adjacent to the extraction target. This is a bypass of the fix for CVE-2020-12265. The correct check requires appending a path separator: realParentPath.indexOf(realOutputPath + path.sep) !== 0.
Product
Decompress
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 9, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Insecure Direct Object ReferenceCVE-2026-12418 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuf_files_data' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite the post_title, post_content, and post_excerpt of any arbitrary post on the site, including posts authored by administrators. Exploitation requires access to any WPUF post submission form; this is achievable by users with no WordPress role, as the wpuf_submit_post AJAX action is gated only by a nonce with no capability check for the downstream post-edit operation.
Product
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Authorization bypassCVE-2026-12406 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary media attachments whose post_author is 0, such as guest and registration-form uploads, via the wpuf_file_del AJAX action. This is exploitable by unauthenticated visitors on any site where a WPUF shortcode is rendered on a front-end page, as this causes the valid wpuf_nonce value to be localized into publicly accessible JavaScript objects (wpuf_upload and wpuf_frontend), satisfying the sole access control gate.
Product
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP CVE-2026-47840 · Other software · CloudFoundry Foundation · reported by security@vmware.comCritical 9.3
A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged group memberships that grant themselves admin scopes. This affects every deployment that authenticates users against LDAP over StartTLS. Affected versions: UAA versions prior to v78.13.0; Cf-deployment versions prior to v56.2.0.
Product
UAA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cloudfoundry.org
Jul 9, 2026Everest Forms: Does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directoryCVE-2026-11571 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directory, allowing unauthenticated attackers to retrieve other users' form submission records via predictable, enumerable filenames.
Product
Everest Forms
Fixed in
3.5.0
What to do
Update Everest Forms to 3.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 8, 2026BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resCVE-2026-14967 · Other software · Black Lantern Security · reported by cves@blacklanternsecurity.comLow 3.1
BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.
Product
BBOT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jul 8, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Insecure Direct Object ReferenceCVE-2026-5459 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment_page() function due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.
Product
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 8, 2026A flaw was found in 389 Directory Server.CVE-2026-15041 · Other software · Red Hat · reported by Red HatLow 3.7
A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.
Product
Red Hat Directory Server 11
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Jul 8, 2026Jssor Slider by jssor.com: Directory TraversalCVE-2026-14244 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Jssor Slider by jssor.com plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.1.24 via the 'url' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Jssor Slider by jssor.com
Affected
up to 3.1.24
What to do
Affects up to 3.1.24. Update Jssor Slider by jssor.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 7, 2026sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.CVE-2026-59998 · Other software · OpenBSD · reported by MITREMedium 4.8
sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.
Product
OpenSSH
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info openssh.org
Jul 7, 2026scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.CVE-2026-59996 · Other software · OpenBSD · reported by MITREMedium 4.2
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.
Product
OpenSSH
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info openssh.org
Jul 7, 2026A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, aCVE-2026-14969 · Other software · Red Hat · reported by Red HatMedium 4.4
A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.
Product
Red Hat Directory Server 11
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Jul 7, 2026A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base).CVE-2026-14940 · Other software · Red Hat · reported by Red HatMedium 5.3
A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name (RDN), the server can write past the end of a heap allocation while sorting RDN attribute-value pairs. An unauthenticated remote attacker can trigger this condition by sending an LDAP operation whose DN reaches the DN normalization routine, such as a search with a crafted base DN. This can corrupt heap memory and may cause denial of service.
Product
Red Hat Directory Server 11
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Jul 7, 2026The encryption algorithm used to protect the configuration of user accounts, stored in the built-in user directory of PcVue projects, all versions prior to 17.0CVE-2026-14868 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932High 8.4
The encryption algorithm used to protect the configuration of user accounts, stored in the built-in user directory of PcVue projects, all versions prior to 17.0.0, is not strong enough for the level of protection required. A local attacker could alter the existing configuration and ultimately gain privileged access to the PcVue application.
Product
PcVue
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pcvue.com
Jul 7, 2026Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0.CVE-2026-14867 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Medium 6.8
Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials. Active Directory accounts are not affected by this vulnerability.
Product
PcVue
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pcvue.com
Jul 7, 2026A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base).CVE-2026-11610 · Other software · 389ds · reported by Red HatHigh 8.8
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of attacker-controlled data to overflow the buffer, causing a denial of service (server crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with a valid Kerberos ticket, any enrolled host, or any service account can trigger this vulnerability over the network after authenticating via GSSAPI. The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow in schema.c only.
Product
389-ds-base
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jul 6, 2026Esri ArcGIS Server contains a directory traversal vulnerability.CVE-2026-9181 · Other software · Esri · reported by psirt@esri.comCritical 9.8
Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow overwriting sensitive files on the system. Abuse of this issue can allow full administrative access to ArcGIS Server, with high impact to confidentiality, integrity, and availability. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes.
Product
ArcGIS Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record esri.com
Jul 3, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library).CVE-2026-47896 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 through 4.8.0-beta00017. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.
Product
Apache Lucene.Net
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Jul 3, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library).CVE-2026-47897 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.
Product
Apache Lucene.Net
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Jul 3, 2026CM Business Directory – Optimise and showcase local business: Stored Cross-Site ScriptingCVE-2026-8892 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CM Business Directory – Optimise and showcase local business plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Business Address Meta Fields in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the malicious payload is stored in post meta rather than post_content, WordPress's unfiltered_html capability restriction does not apply, meaning contributors who lack that capability can still inject executable HTML via the address meta fields such as cmbd_address, cmbd_cityTown, cmbd_stateCounty, cmbd_postalcode, cmbd_region, and cmbd_country.
Product
CM Business Directory – Optimise and showcase local business
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update CM Business Directory – Optimise and showcase local business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-8489 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'about_me' parameter in all versions up to, and including, 2.11.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.11.4
What to do
Affects up to 2.11.4. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2026AR for WooCommerce: Directory TraversalCVE-2026-14352 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The three intended access controls all fail: valid nonces are freely minted by unauthenticated callers via the nopriv ar_get_fresh_nonce and ar_process_user_image AJAX handlers; the AES-256-CBC encryption key is derived from get_option('ar_licence_key'), which returns false on default free installations and yields a predictable key attackers can use to encrypt their own path payloads; and the Referer check is trivially bypassed because the Referer header is attacker-controlled.
Product
AR for WooCommerce
Affected
up to 8.40
What to do
Affects up to 8.40. Update AR for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026AR for: Directory TraversalCVE-2026-14327 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires an attacker to first obtain a valid nonce and secure nonce via the publicly accessible ar_get_fresh_nonce and ar_process_user_image nopriv AJAX handlers, and to reproduce the encryption key locally — both steps are fully achievable by an unauthenticated attacker on any default free or unlicensed installation where ar_licence_key is unset.
Product
AR for
Affected
up to 8.40
What to do
Affects up to 8.40. Update AR for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.CVE-2026-57682 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions.CVE-2026-57681 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Perfmatters: Directory TraversalCVE-2026-13251 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the Local Google Fonts feature to be enabled (disabled by default), pretty permalinks to be active, and RSS feed links to remain enabled in the plugin settings.
Product
Perfmatters
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update Perfmatters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record perfmatters.io plugins.trac.wordpress.org
Jul 1, 2026HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file aCVE-2026-5051 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.4
HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.
Product
Vault
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.hashicorp.com
Jul 1, 2026WP-BusinessDirectory: Unauthenticated Arbitrary File DeletionCVE-2026-6070 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The task=upload.remove endpoint is accessible without authentication via the plugin's frontend routing system. The _filename parameter is accepted with RAW filter (no sanitization), and the helper function makePathFile() only normalizes directory separator characters without stripping path traversal sequences (../). When combined with the _path_type=2 parameter, which sets the base directory to the plugin's site folder, an attacker can supply a _filename value containing ../ sequences to traverse outside the plugin directory and call PHP's unlink() on arbitrary files — including wp-config.php, wp-config-backup.php, or other critical server files accessible to the web server process. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.
Product
WP-BusinessDirectory
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP-BusinessDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 30, 2026An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area.CVE-2026-52868 · Other software · OFFIS DICOM · reported by ics-cert@hq.dhs.govHigh 8.8
An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a multi-area deployment, this can cross departmental or clinic data separation.
Product
DCMTK Toolkit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 30, 2026A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both reCVE-2026-50003 · Other software · OFFIS DICOM · reported by ics-cert@hq.dhs.govCritical 9.3
A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
Product
DCMTK Toolkit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 30, 2026An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expecCVE-2026-44628 · Other software · OFFIS DICOM · reported by ics-cert@hq.dhs.govHigh 8.7
An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.
Product
DCMTK Toolkit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 30, 2026Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers to write files outside the intended memory root directory by supplying CVE-2026-58173 · Other software · HKUDS · reported by VulnCheckMedium 6
Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers to write files outside the intended memory root directory by supplying a malicious memory_type value containing path traversal sequences through the remember tool. Attackers can manipulate the memory_type parameter in the persistent memory store to cause the application to write arbitrary Markdown files to unintended locations on the filesystem.
Product
Vibe-Trading
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 30, 2026Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in runCVE-2026-58171 · Other software · HKUDS · reported by VulnCheckLow 2.3
Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in run_dir (agent/src/swarm/store.py). A crafted run identifier supplied through the MCP swarm tools causes the application to read arbitrary run.json files outside the runs directory and to overwrite existing run.json files at traversed locations.
Product
Vibe-Trading
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 30, 2026Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal identifier onto the broker proposals directory without sanitizatiCVE-2026-58170 · Other software · HKUDS · reported by VulnCheckHigh 7.2
Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal identifier onto the broker proposals directory without sanitization (agent/src/live/mandate/commit.py). A proposal identifier containing path traversal sequences causes the application to load an attacker-controlled JSON file as an authoritative live trading mandate. Combined with the file upload endpoint, an admitted caller can write a JSON file to a known location and traverse to it, and because the ceilings validation is skipped when ceilings are absent, the attacker fully controls the committed mandate.
Product
Vibe-Trading
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 30, 2026ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability CVE-2026-48314 · Websites & servers · Adobe · reported by AdobeMedium 6.5
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to gain limited read and write access to unauthorized files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction.
Product
ColdFusion 2025
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Jun 30, 2026ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability CVE-2026-48313 · Websites & servers · Adobe · reported by AdobeCritical 9.3
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
Product
ColdFusion 2025
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Jun 30, 2026Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path traversal in peer-supplied metadata.CVE-2026-57079 · Other software · SANKO · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.3
Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path traversal in peer-supplied metadata. Net::BitTorrent validates file path components only on the .torrent-file ingest path. The peer and magnet metadata path (_on_metadata_received, reached from the BEP09 ut_metadata extension) passes attacker-supplied file names straight to Storage::add_file and Storage::_parse_file_tree, where Path::Tiny's child() does not collapse "..". A v2 file tree key, a v1 files[].path element, or a single-file name containing ".." segments therefore resolves outside the download directory. Because the peer also controls the piece hashes and the served bytes, content verification passes, so a malicious magnet or peer writes attacker-chosen content to an attacker-chosen path on the downloading host.
Product
Net::BitTorrent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com metacpan.org
Jun 30, 2026PixMagix – WordPress Image Editor: Directory TraversalCVE-2026-11367 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The PixMagix – WordPress Image Editor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.2 via the move_image_on_server function. This makes it possible for authenticated attackers, with author-level access and above, to write files with attacker-controlled content to arbitrary locations on the server. The unsanitized 'layers[].id' parameter is concatenated into a filesystem path and passed to PHP's copy() function, allowing traversal sequences (e.g. '../../') to escape the intended upload directory and write attacker-supplied file contents to arbitrary paths accessible by the web server process. The save_template REST endpoint is gated by the create_projects permission (edit_pixmagix + upload_files), which Author-level users hold by default after plugin activation, making this exploitable by any Author on sites running PixMagix.
Product
PixMagix – WordPress Image Editor
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update PixMagix – WordPress Image Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.