Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
390,007 results · page 153 of 7801
Oct 15, 2026A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a ..CVE-2026-79824 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8
A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive.
- Product
- HPE NonStop Python 3.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station.CVE-2026-53882 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.7
An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Virtualization Station 4.1.1.130 and later
- Product
- Virtualization Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Qsirch.CVE-2026-50619 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.3
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later
- Product
- Qsirch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie.CVE-2026-50612 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.4
An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuMagie 2.9.2 and later
- Product
- QuMagie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service.CVE-2026-47790 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.3
A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP Service 1.5.5 and later QuFTP Service 1.6.5 and later
- Product
- QuFTP Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An OS command injection vulnerability has been reported to affect HybridDesk Station.CVE-2026-47786 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.3
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later
- Product
- HybridDesk Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station.CVE-2026-44084 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.7
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A relative path traversal vulnerability has been reported to affect QuMagie.CVE-2026-41545 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.6
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later
- Product
- QuMagie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central.CVE-2026-41541 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station.CVE-2026-39997 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.9
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later
- Product
- HybridDesk Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3.CVE-2026-39991 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.8
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later
- Product
- Notes Station 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station.CVE-2026-39989 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
- Product
- Download Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Video Station.CVE-2026-34015 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.7
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station.CVE-2026-34014 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.4
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
- Product
- Download Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3.CVE-2026-34009 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.4
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
- Product
- Notes Station 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3.CVE-2026-34008 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.5
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
- Product
- Notes Station 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An OS command injection vulnerability has been reported to affect Notes Station 3.CVE-2026-34007 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.9
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
- Product
- Notes Station 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE.CVE-2026-34006 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.3
A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later
- Product
- sMedio DTCP MOVE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A SQL injection vulnerability has been reported to affect Video Station.CVE-2026-26245 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.1
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A SQL injection vulnerability has been reported to affect Video Station.CVE-2026-26244 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.1
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Qsync Central.CVE-2026-26243 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.2
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.6 and later Qsync Central 5.1.0.2 and later Qsync Central 5.2.0.4 and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object.CVE-2026-19864 · Other software · reported by emo@eclipse.orgMedium 5.6
Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.CVE-2026-19863 · Other software · reported by emo@eclipse.orgCritical 9.3
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED. Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission setCVE-2026-18662 · Other software · reported by emo@eclipse.orgMedium 6.9
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through thCVE-2026-18660 · Other software · reported by emo@eclipse.orgHigh 8.8
In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-CVE-2026-18659 · Other software · reported by emo@eclipse.orgMedium 6.9
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme.CVE-2026-96614 · Other software · GEO CORPORATION · reported by vultures@jpcert.or.jpMedium 5.1
"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID.
- Product
- "ゲオアプリ" for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior.CVE-2026-79823 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 4
HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior.
- Product
- HPE NonStop EMS Distributor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).CVE-2026-77711 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.
- Product
- Eclipse Jetty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpCCVE-2026-76184 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`. This also mean that the attacker must have an evil application deployed on the same domain as the target.
- Product
- Eclipse Jetty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the reCVE-2026-76182 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.
- Product
- Eclipse Jetty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted bCVE-2026-75559 · Other software · Ministry of Land, Infrastructure, Transport and Tourism · reported by vultures@jpcert.or.jpMedium 6.9
The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted by the application, potentially leading to the exposure of API integration credentials such as an access ID and access key.
- Product
- Vehicle Inspection Certificate Viewer (for Android)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026"Handmade Marketplace App - Creema" provided by CREEMA LTD.CVE-2026-72528 · Other software · CREEMA LTD. · reported by vultures@jpcert.or.jpMedium 5.1
"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up by the attacker may be displayed within the app's screen of a user. As a result, the user may become a victim of a phishing attack.
- Product
- "Handmade Marketplace App - Creema" for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext.CVE-2026-63315 · Other software · Slican · reported by cvd@cert.plHigh 8.2
WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account. This issue was fixed in IPx series version 6.62.0100.
- Product
- IPx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint.CVE-2026-63314 · Other software · Slican · reported by cvd@cert.plHigh 8.7
WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks. This issue was fixed in IPx series version 6.62.0100.
- Product
- IPx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Slican telephone exchanges use symmetric encryption for TCP/IP communication.CVE-2026-35088 · Other software · Slican · reported by cvd@cert.plHigh 8.2
Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication. This issue was fixed in IPx series version 6.62.0100. The issue STILL EXISTS in End-Of-Life telephone exchanges: - CCT-1668 (CCT1CPU) - MAC-6400 - CXS-0424 These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.
- Product
- IPx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServCVE-2026-18661 · Other software · reported by emo@eclipse.orgHigh 8.8
In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper HistorCVE-2026-16438 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpCritical 9.4
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
- Product
- GENESIS64
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmitsubishielectric.com
Oct 15, 2026Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prCVE-2026-16437 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.1
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and write the management file. But the management file is protected by Windows. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
- Product
- GENESIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmitsubishielectric.com
Oct 15, 2026Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prCVE-2026-16436 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpCritical 9.2
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
- Product
- GENESIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmitsubishielectric.com
Oct 15, 2026undici is an HTTP client library for Node.js.CVE-2026-109855 · Other software · undici · reported by ce714d77-add3-4f53-aff5-83d477b104bbHigh 7.5
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Oct 15, 2026"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the password of a uCVE-2026-105271 · Other software · GEO CORPORATION · reported by vultures@jpcert.or.jpMedium 5.1
"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the password of a user of the affected application.
- Product
- "ゲオアプリ" for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log.CVE-2026-104618 · Other software · SUSE · reported by meissner@suse.deMedium 6.9
On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it.
- Product
- SUSE Linux Enterprise Server 16.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comsuse.com
Oct 15, 2026There are two invocations of `qrencode` to display a QR code for scanning.CVE-2026-104617 · Other software · SUSE · reported by meissner@suse.deMedium 5.9
There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system.
- Product
- SUSE Linux Enterprise Server 16.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comsuse.com
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloCVE-2026-103224 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle MySQL server can send a continuous stream of packets with the maximum payload length (0xFFFFFF), preventing the end-of-message condition from being reached, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-mysql-client.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length CVE-2026-103223 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-pg-client.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum siCVE-2026-102477 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed size and not the actual size of the uncompressed content. This can be used to force a gRPC endpoint to allocate more bytes than the value defined by the configuration, making the endpoint vulnerable to compression bomb attacks. The impacted component is io.vertx:vertx-gprc-server.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocolCVE-2026-102469 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call with no ObjectInputFilter or class allowlist. This code path is triggered when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50). However, DB2 does not support this type of UDT. The FDOCA 0x50 type is never sent by a legitimate DB2 server. Nevertheless, a malicious or man-in-the-middle DRDA server could craft a response with a 0x50-tagged column, causing the client to deserialize arbitrary attacker-controlled bytes on the Vert.x event loop before any application code can inspect or reject the data. If a Java deserialization gadget chain is present on the application's classpath, this enables remote code execution. Without a gadget chain, denial of service is possible via crafted object graphs. TLS is disabled by default, making man-in-the-middle exploitation feasible. The impacted component is io.vertx:vertx-db2-client.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an aCVE-2026-102466 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column definitions based on a server-declared column count with no upper-bound validation. A malicious or compromised MySQL server, or an attacker with man-in-the-middle positioning, can send a crafted result set packet with an extremely large column count, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Netty event loop thread, causing a complete denial of service for all connections and verticles in the Vert.x application. The impacted component is io.vertx:vertx-mysql-client.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inCVE-2026-102464 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map (qos2inbound) while awaiting the corresponding PUBREL packet to complete the QoS 2 handshake. This map has no size limit; the maxInflightQueue option is enforced only on the outbound publish path and does not constrain inbound message retention. A malicious or compromised MQTT broker can exploit this by sending QoS 2 PUBLISH messages with distinct packet identifiers and withholding the PUBREL responses. Each incomplete handshake causes the client to retain the full publish message (topic, payload, and metadata) indefinitely, leading to unbounded memory growth in the Vert.x process. This can degrade the MQTT-consuming application or cause out-of-memory termination. The impacted component is io.vertx:vertx-mqtt.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.