Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,829 results · page 15 of 137
Oct 13, 2026Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.CVE-2026-102196 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.CVE-2026-102195 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-102194 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.CVE-2026-102193 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-102191 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-102189 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-102188 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-100225 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.CVE-2026-100217 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-100216 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.CVE-2026-100205 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.
- Product
- Windows Sysinternals Process Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.CVE-2026-100203 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.CVE-2026-100201 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.CVE-2026-100200 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026asteval is a Python expression evaluator designed for restricted execution.CVE-2026-102734 · Other software · lmfit · reported by GitHubMedium 5.5
asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9.
- Product
- asteval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection.CVE-2026-65141 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.
- Product
- Isaac Lab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Oct 12, 2026IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.CVE-2026-75782 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.
- Product
- Aspera Enterprise WebApps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevatedCVE-2026-105464 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.
- Product
- Db2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed oCVE-2026-109364 · Other software · ZcashFoundation · reported by VulnCheckMedium 6.9
Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to restore access for banned peers.
- Product
- zebra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuerCVE-2026-85954 · Other software · Progress Software Corporation · reported by security@progress.comHigh 8.6
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions.
- Product
- MarkLogic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 11, 2026Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus CVE-2026-108736 · Other software · alexjustesen · reported by VulnCheckMedium 6.3
Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowlisted address to read /prometheus metrics and reach protected web and API endpoints.
- Product
- speedtest-tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026SiteVault – Backup, Restore, Migration & Cloning: Improper Control of Generation of Code ('Code Injection')CVE-2026-42696 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migration & Cloning: from n/a through 1.5.19.
- Product
- SiteVault – Backup, Restore, Migration & Cloning
- Affected
- up to 1.5.19
- What to do
- Affects up to 1.5.19. Update SiteVault – Backup, Restore, Migration & Cloning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backendCVE-2026-108162 · Other software · smp46 · reported by VulnCheckMedium 6.9
Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses.
- Product
- pingvin-share-x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.CVE-2026-108502 · Other software · ZTE · reported by psirt@zte.com.cnLow 3.3
ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.
- Product
- Z80 Ultra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalCVE-2026-104084 · Other software · Smartertools · reported by VulnCheckHigh 8.7
SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token issued before an administrator demotion, or a demoted user whose session was not actively polling at the time of demotion, can replay the stale token to obtain a new access token retaining the higher-privilege role (such as DomainAdmin or SysAdmin) until natural token expiry.
- Product
- Smartermail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.evan.latsmartertools.com
Oct 8, 2026Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.CVE-2026-96207 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Partner Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.CVE-2026-94510 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Bookings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.CVE-2026-69435 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
- Product
- Azure SRE Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mCVE-2026-107572 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comMedium 6.5
Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the matched value's length raised to the number of wildcards, so a pattern such as '*a*a*a*b' over 800 characters took 44 seconds; and 'deleteheader' erased the fields it removed one at a time, so removing many fields of one name over a message's header cost O(N^2) (80,000 fields took 18.8 seconds). Sieve filters run on the small, shared delivery thread pool, so an account holder whose active script does this, fed a few messages they can send themselves, empties the pool and stops delivery for the whole server. The script is the account holder's own and cannot be set for another user.
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation.CVE-2026-85486 · Other software · Brocade · reported by sirt@brocade.comHigh 8.6
Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code on the server and take control of the application.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permisCVE-2026-102488 · Other software · Octopus Deploy · reported by security@octopus.comHigh 8.7
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.com
Oct 7, 2026Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names.CVE-2026-89322 · Other software · HashiCorp · reported by security@hashicorp.comHigh 7.2
Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For oCVE-2026-107271 · Other software · gophish · reported by VulnCheckMedium 6.9
Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never triggers, enabling unlimited password guessing and credential stuffing.
- Product
- gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.ostorlab.cogithub.com
Oct 6, 2026When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated theCVE-2026-79960 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2High 7.1
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and change repository visibility through push options, for example making a private repository public. Pull requests created through the AGit flow with a deploy key were also attributed to the owner.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 6, 2026An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their user privilCVE-2026-79814 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.7
An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their user privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow a local attacker to execute arbitrary code with elevated privileges on the affected system.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A privilege escalation vulnerability in the ClearPass Policy Manager OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user pCVE-2026-79806 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.8
A privilege escalation vulnerability in the ClearPass Policy Manager OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges. A successful exploit allows a malicious user to escalate to root privileges on the affected Linux client.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute aCVE-2026-106378 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.3
Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Oct 6, 2026Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with writCVE-2026-95105 · Other software · danielberkompas · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.2
Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak.Ciphers.AES.CTR encrypts with AES-256 in CTR mode and stores the key tag, the IV and the ciphertext with no MAC. decrypt/2 checks only the key tag and the minimum length before it returns the plaintext, and Cloak.Ciphers.Deprecated.AES.CTR decrypts the legacy format the same way. CTR is a stream cipher, so a value XORed into the stored ciphertext is XORed into the plaintext at the same offset. An attacker who can write to the encrypted store (for example through SQL injection or a compromised replica) and who knows or can guess a stored plaintext can replace it with any value of the same length. The application receives that value with no error. This issue affects cloak: from 0.1.0-pre onward.
- Product
- cloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 6, 2026Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions.CVE-2026-105071 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions.
- Affected
- up to 1.5.17
- What to do
- Affects up to 1.5.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2026Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-96940 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Exchange Server 2016 Cumulative Update 23
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks.CVE-2026-104420 · Other software · ZcashFoundation · reported by VulnCheckMedium 6.9
Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force block download and Equihash verification without being banned.
- Product
- zebra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 2, 2026Relevanssi – A Better Search: Stored Cross-Site ScriptingCVE-2026-97641 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4.28.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has configured a non-empty value for the "Allowable tags in excerpts" setting, such as the default example value of <p><a><strong>, as the prefix-matching regex must have an allowable tag whose name is a prefix of the injected tag name.
- Product
- Relevanssi – A Better Search
- Affected
- up to 4.28.3
- What to do
- Affects up to 4.28.3. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 2, 2026Relevanssi Premium: Stored Cross-Site ScriptingCVE-2026-103426 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_rt' parameter in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the click-tracking and logging feature to be activated in the plugin settings, and exploitation is trivially accessible to unauthenticated users because a valid _rt_nonce is publicly emitted on every search-results page.
- Product
- Relevanssi Premium
- Affected
- up to 2.31.4
- What to do
- Affects up to 2.31.4. Update Relevanssi Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordrelevanssi.comwordfence.com
Oct 1, 2026An API key is hardcoded and retrievable from the application package.CVE-2026-103097 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.5
An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
- Product
- GV-Eye
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026API key is hardcoded and retrievable from the application package.CVE-2026-103096 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.5
API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
- Product
- GV-Eye
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app).CVE-2026-51897 · Other software · reported by MITRECritical 9.8
RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 1, 2026Missing authorization in module data retrieval allows unauthorized cross-group access to module history.CVE-2026-64948 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.1
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body.CVE-2026-102142 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.2
A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance when the notification was next sent.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation eCVE-2026-101883 · Other software · OpenClaw · reported by VulnCheckMedium 5.3
OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to localhost, private networks, or tailnet services from the user's machine.
- Product
- OpenClaw Windows Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel-mode color transform path where excessive kernel stack use occurs when evaluating YCVE-2026-47506 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel-mode color transform path where excessive kernel stack use occurs when evaluating YCbCr420 display emulation. A successful exploit of this vulnerability might lead to denial of service.
- Product
- GeForce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.