Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,279 results · page 15 of 346
Oct 12, 2026ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compressioCVE-2026-109268 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursiCVE-2026-109267 · Other software · ImageMagick · reported by VulnCheckMedium 6.9
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived daCVE-2026-109266 · Other software · ImageMagick · reported by VulnCheckMedium 6.9
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect stringCVE-2026-109265 · Other software · ImageMagick · reported by VulnCheckMedium 6.9
ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack.CVE-2026-109264 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operatioCVE-2026-109263 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handlCVE-2026-109262 · Other software · ImageMagick · reported by VulnCheckMedium 6.9
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization CVE-2026-109261 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initializatiCVE-2026-109260 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents.CVE-2026-109259 · Other software · ImageMagick · reported by VulnCheckMedium 6.9
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry faCVE-2026-109258 · Other software · ImageMagick · reported by VulnCheckLow 2
ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package paCVE-2026-85948 · Other software · Progress Software Corporation · reported by security@progress.comCritical 9.9
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.
- Product
- MarkLogic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 12, 2026Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations.CVE-2026-85947 · Other software · Progress Software Corporation · reported by security@progress.comCritical 9.9
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.
- Product
- MarkLogic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 12, 2026A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path.CVE-2026-108094 · Other software · Red Hat · reported by Red HatHigh 7.8
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 12, 2026In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavCVE-2026-93694 · Other software · Progress · reported by security@progress.comMedium 4
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.
- Product
- ShareFile Storage Zones Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowinCVE-2026-105081 · Other software · ImageMagick · reported by VulnCheckLow 2
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Hotel Booking: Does not implement CSRF protection on its administrative booking order managementCVE-2026-84166 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.
- Product
- Hotel Booking
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied pCVE-2026-21123 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.7
Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Oct 10, 2026ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by barCVE-2026-108693 · Other software · ImageMagick · reported by VulnCheckHigh 7.3
ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with ImageMagick privileges when PDF, PostScript, or EPS files are converted.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Real Estate Manager – Property Listing and Agent Management: Stored Cross-Site ScriptingCVE-2026-96667 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The reCAPTCHA check is trivially bypassed by omitting the g-recaptcha-response parameter entirely, since validation only runs when that parameter is present.
- Product
- Real Estate Manager – Property Listing and Agent Management
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update Real Estate Manager – Property Listing and Agent Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 9, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-62376 · Other software · go-vikunja · reported by GitHubHigh 8.1
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over user accounts without knowing passwords. Version 2.4.0 fixes the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-62367 · Other software · go-vikunja · reported by GitHubHigh 7.5
Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+password) account using only the `email` claim from the IdP. The fallback never checks an `email_verified` (or Microsoft `xms_edov`) signal and never requires the matched account's password. An attacker who can obtain a token from the configured issuer carrying a victim's email logs in as that victim with a full session, with no consent or interaction from the victim. Version 2.4.0 fixes the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-57458 · Other software · go-vikunja · reported by GitHubHigh 8.1
Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers.CVE-2026-108264 · Other software · wizarrrr · reported by GitHubCritical 9.1
Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2 environment with application globals exposed. An authenticated user able to create steps, or an administrator importing an untrusted bundle through POST /settings/wizard/import, could execute arbitrary Python when GET /wizard/{server}/{idx} rendered the stored step; app/jinja_filters.py and app/services/wizard_widgets.py contained additional evaluation sinks. This could execute operating-system commands as the application user, disclose the Flask SECRET_KEY, access connected service credentials and the database, and produce stored cross-site scripting. This issue is fixed in 2026.9.1.
- Product
- wizarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Tina is a headless content management system.CVE-2026-108261 · Other software · tinacms · reported by GitHubCritical 9.3
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.
- Product
- tinacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Tina is a headless content management system.CVE-2026-108260 · Other software · tinacms · reported by GitHubHigh 7.6
Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.
- Product
- tinacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Tina is a headless content management system.CVE-2026-108259 · Other software · tinacms · reported by GitHubHigh 8.2
Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.
- Product
- tinacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Mindwtr is a free offline-first task management application for desktop and mobile.CVE-2026-107857 · Other software · dongdongbh · reported by GitHubMedium 4.4
Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr_cloud_token and @mindwtr_webdav_password. A party with access to the application database or an exposed device backup can recover these credentials and use them to access the user's synchronized tasks and attachments. This issue is fixed in version 1.1.5.
- Product
- Mindwtr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Jexactyl is a customisable game management panel and billing system.CVE-2026-107854 · Other software · Jexactyl · reported by GitHubMedium 5.4
Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled server_id and loads the server without restricting the lookup to servers owned by the authenticated account. On installations with billing enabled, an authenticated user can renew or unsuspend another tenant's billable server when its renewal_date is non-null and more than seven days away, even without a subuser relationship to that server. This issue is fixed in version 4.0.5.
- Product
- Jexactyl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Jexactyl is a customisable game management panel and billing system.CVE-2026-107852 · Other software · Jexactyl · reported by GitHubHigh 7.1
Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when payment_status is paid but does not compare amount_total or currency with the referenced order and configured billing currency. On an instance where the billing module is enabled and a Stripe secret key is configured, an authenticated client can therefore complete a lower-value or mismatched-currency payment and cause the order to be processed, provisioning, renewing, upgrading, or unsuspending the purchased server for less than the required price. This issue is fixed in version 4.0.5.
- Product
- Jexactyl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration.CVE-2026-104117 · Other software · illumos · reported by 0ca53633-f0b5-4853-ba72-e0a2e62000d0Low 1.9
A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c does not require the solaris.network.interface.config authorization for the IPMGMT_CMD_IPMP_UPDATE command, although its handler, ipmgmt_ipmp_update_handler(), writes to the persistent ipadm configuration when the IPMGMT_PERSIST flag is set. An unprivileged local user can therefore add interfaces to, or remove them from, existing IPMP groups in the stored configuration. The running configuration is not changed; the modification takes effect when the stored configuration is next applied, such as at boot, and may disrupt network connectivity. The flaw has existed since 2021 (illumos-gate commit a73be61a), and affects any illumos distribution prior to illumos-gate commit e8d3efa1.
- Product
- illumos-gate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon.CVE-2026-104113 · Other software · OmniOS · reported by 0ca53633-f0b5-4853-ba72-e0a2e62000d0Medium 5.4
A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees the caller's credential with ucred_free() immediately after reading the user ID, and frees it a second time on the error path if the authorization check fails. An unprivileged local user who does not hold the solaris.network.interface.config authorization can send such a request, for example IPMGMT_CMD_RESETIF, to the ipmgmtd door, causing ipmgmtd to abort; repeated requests place the svc:/network/ip-interface-management service into maintenance, preventing IP interface configuration. The early free was introduced in 2014 to support lx-branded zones (OmniOS commit 4c170900) and is not present in upstream illumos-gate. It affects OmniOS r151020 and later, and SmartOS, prior to the fix.
- Product
- OmniOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co.CVE-2026-92085 · Other software · TMT Machinery Industry and Trade Co. Ltd. · reported by iletisim@usom.gov.trMedium 5.4
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS. This issue affects Talassoft Industrial Management Software: before V16.0.1.
- Product
- Talassoft Industrial Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026ProcessMaker is an open source workflow management software suite.CVE-2026-107803 · Other software · ProcessMaker · reported by GitHubMedium 6.5
ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is vulnerable to SQL injection through the order_by parameter because `ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering()` concatenates a user-controlled process_requests column name into a DB::raw() SQL subquery without validation or parameter binding. Any authenticated user can use blind, time-based queries to infer and extract data accessible to the ProcessMaker database account. This issue is fixed in version 2026.14.3.
- Product
- processmaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026SendPress Newsletters: Does not check the user's capability on several newsletter-management actionsCVE-2026-92989 · WordPress plugins & themes · reported by WPScanMedium 4.3
The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue.
- Product
- SendPress Newsletters
- Affected
- up to 1.26.1.20
- What to do
- Affects up to 1.26.1.20. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Code Snippets: Does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored recordCVE-2026-106095 · WordPress plugins & themes · reported by WPScanLow 3.3
The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite network to activate, deactivate and reprioritise network-scoped snippets that run across every site in the network.
- Product
- Code Snippets
- Fixed in
- 3.10.0
- What to do
- Update Code Snippets to 3.10.0 or newer.
Oct 9, 2026OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management.CVE-2026-107886 · Other software · OpenPrinting · reported by MITRELow 2.3
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.
- Product
- CUPS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for criticaCVE-2026-84249 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.
- Product
- Guardium Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713CVE-2026-79842 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comCritical 9.1
An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713
- Product
- HPE Intelligent Management Center (iMC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnCVE-2026-11936 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.9
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- Security Verify Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2026-107397 · Other software · indico · reported by GitHubMedium 4.4
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, the minute editor conflict UI can execute attacker-controlled script in the viewer's browser in the Indico origin. This issue is fixed in version 3.3.13.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2026-107396 · Other software · indico · reported by GitHubMedium 5.4
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user who follows one of these URLs can execute attacker-controlled script in the user's browser in the Indico origin. This issue is fixed in version 3.3.13.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2026-107395 · Other software · indico · reported by GitHubMedium 4.3
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing event is accessible. The missing access check can disclose session metadata such as the title, description, and conveners. This issue is fixed in version 3.3.13.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2026-107394 · Other software · indico · reported by GitHubMedium 6.8
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features. This issue is fixed in version 3.3.13.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoinCVE-2026-104075 · Other software · TVU Networks · reported by VulnCheckCritical 9.3
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript validation, to receive a valid session cookie regardless of the password value and gain full administrative control of the device's web management interface.
- Product
- TVU Receiver / Transceiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode-white.comvulncheck.com
Oct 8, 2026The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execuCVE-2026-107704 · Other software · jtescher · reported by VulnCheckCritical 9.3
The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges.
- Product
- image_optimizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 8, 2026Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document contaiCVE-2026-106433 · Other software · MongoDB · reported by cna@mongodb.comHigh 8.7
Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory.
- Product
- libmongocrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors toCVE-2026-107639 · Other software · ILIAS-eLearning e.V. · reported by VulnCheckHigh 8.7
ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.
- Product
- ILIAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocu.ilias.dedocu.ilias.de
Oct 8, 2026A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service.CVE-2026-107604 · Other software · Red Hat · reported by Red HatMedium 4.9
A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator with only the read-only view-clients role can access the active primary secret of any confidential client, which should normally be restricted. This exposed secret can be used to impersonate the client and gain unauthorized access to its associated service account permissions.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 8, 2026In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored managemeCVE-2026-87428 · Other software · Brocade · reported by sirt@brocade.comHigh 8.4
In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.