Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,040 results · page 16 of 81
Aug 11, 2026On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the "Floating point ABI" choice, which defaults to CONFIG_FP_HARDABI.CVE-2026-11985 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgLow 3.6
On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the "Floating point ABI" choice, which defaults to CONFIG_FP_HARDABI. Both FP_HARDABI and FP_SOFTABI permit the compiler to emit hardware FP instructions in any function, even code that never uses floating-point types. However, the callee-saved FP registers (s16-s31 / d8-d15) are only saved and restored across a context switch when CONFIG_FPU_SHARING is enabled (arch/arm/core/cortex_m/swap_helper.S and arch/arm/core/cortex_a_r/swap_helper.S), and prior to this fix selecting an ABI did not enable FPU register sharing, which defaults off. In a build that enables the FPU with the default ABI but leaves CONFIG_FPU_SHARING disabled, the kernel preserves no callee-saved FP register state across thread switches. The documented precondition for this "unshared" mode — that only a single thread ever executes FP instructions — is silently violated because the compiler may generate FP instructions in every thread. Under CONFIG_USERSPACE, where threads are mutually isolated, this becomes an information-disclosure boundary crossing: a victim thread can leave secret-derived values in s16-s31, and a co-resident unprivileged th
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions.CVE-2026-66776 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.9
SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful exploitation requires the attacker to have previously observed matching session values out-of-band, which makes the attack complex to execute. This could result in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default.CVE-2026-66775 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an attacker-controlled identity, resulting in a low impact on integrity. There is no impact on confidentiality and availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not enforce sufficient flow control in certain functionality.CVE-2026-66761 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and integrity.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpointCVE-2025-30237 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 8.7
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.
- Product
- HB810(US2) V1.0/1.6/2.0/2.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path.CVE-2026-12624 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.3
Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was intended to be denied access to. This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() put_prev_task_scx()CVE-2026-68421 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() put_prev_task_scx() warns when a runnable task drops to a lower sched_class without SCX_OPS_ENQ_LAST, on the assumption that balance_one() would have kept it running. Core scheduling breaks that: a forced-idle SMT sibling reschedules through the core_pick fast path in pick_next_task(), which skips pick_task_scx() and thus balance_one(), so a runnable task can drop to idle with ENQ_LAST unset. Gate the warning on sched_cpu_cookie_match(): a cookie mismatch means core scheduling forced the idle, while a match (or core scheduling off) still catches a genuine missing-ENQ_LAST drop.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 10, 2026In the Linux kernel, the following vulnerability has been resolved: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists Unconditionally whitelisting OCVE-2026-68267 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists Unconditionally whitelisting OA registers is a security violation. Set RING_FORCE_TO_NONPRIV_DENY bit in OA nonpriv slots, so that OA registers don't get whitelisted by default after probe, gt reset, resume and engine reset. (cherry picked from commit 90511bdcfda97211c01f1d945d4ea616578d8fca)
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 10, 2026In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix indefinite fence wait during GPU reset pre_reset only force-completeCVE-2026-68237 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix indefinite fence wait during GPU reset pre_reset only force-completes fences of MAPPED queues. A queue in any other state (e.g. mid-eviction) keeps its last_fence pending; after a GPU reset that fence never signals, so the eviction/suspend worker and process teardown (amdgpu_evf_mgr_flush_suspend) wait on it forever and wedge the machine: INFO: task kworker/6:28 blocked for more than 120 seconds. Workqueue: events amdgpu_eviction_fence_suspend_worker [amdgpu] Call Trace: dma_fence_wait_timeout+0x7e/0x130 amdgpu_userq_evict+0x67/0x140 [amdgpu] amdgpu_eviction_fence_suspend_worker+0xd8/0x160 [amdgpu] process_scheduled_works+0xa6/0x420 Force-complete every queue's fence regardless of state. The unmap and mark-hung step stays gated on MAPPED, since unmapping a queue that is not mapped is invalid. (cherry picked from commit 9102b39fa924dcc3dc75a3137bfa9633c40b88c0)
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 10, 2026UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.CVE-2026-65948 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0. Note: UnixAuth is NOT a recommended option for production deployments. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
- Product
- Apache Ranger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 10, 2026Block User Account: Does not enforce its account block on every authentication pathCVE-2026-18960 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.
- Product
- Block User Account
- Fixed in
- 2.0.1
- What to do
- Update Block User Account to 2.0.1 or newer.
Aug 10, 2026Login & Register Forms: Does not enforce its password reset attempt limit against a server-derived valueCVE-2026-18469 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.
- Product
- Login & Register Forms
- Fixed in
- 4.0.2
- What to do
- Update Login & Register Forms to 4.0.2 or newer.
Aug 8, 2026Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection: Does not perform any capability check on one of its REST API endpointsCVE-2026-16578 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.
- Product
- Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection
- Fixed in
- 1.4.0
- What to do
- Update Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection to 1.4.0 or newer.
Aug 7, 2026Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submittCVE-2026-19016 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.2
Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files.CVE-2026-54201 · Other software · Tobit Laboratories AG · reported by vulnerability@ncsc.chMedium 6.9
Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
- Product
- TeamDavid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchayns.netlabs.infoguard.ch
Aug 6, 2026A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability.CVE-2026-8325 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
- Product
- Revit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Aug 6, 2026A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability.CVE-2026-7406 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
- Product
- Revit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Aug 6, 2026The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to CVE-2026-3418 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Critical 9.1
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.
- Product
- WSO2 API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Aug 6, 2026A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability.CVE-2026-1289 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.
- Product
- Revit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Aug 6, 2026Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potCVE-2026-19152 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.3
Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 6, 2026WPC Name Your Price for WooCommerce: Does not enforce its server-side price allowlist for products configured in "Select" price modeCVE-2026-16620 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed prices and commit a real order at that price (revenue loss / underpriced orders). This is a distinct, unfixed vector from CVE-2025-12115, whose 2.2.0 fix only addressed applying a custom price to products where Name Your Price is disabled and left the Select-mode allowlist unenforced through 2.2.4.
- Product
- WPC Name Your Price for WooCommerce
- Affected
- up to 2.2.4
- Fixed in
- 2.2.5
- What to do
- Update WPC Name Your Price for WooCommerce to 2.2.5 or newer.
Aug 6, 2026Easy Booking: Does not re-enforce a bookable product's configured minimum booking duration on the server sideCVE-2026-14831 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders.
- Product
- Easy Booking
- Fixed in
- 3.5.0
- What to do
- Update Easy Booking to 3.5.0 or newer.
Aug 6, 2026A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability.CVE-2026-11803 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
- Product
- Revit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Aug 6, 2026In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly.CVE-2025-14561 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Critical 9
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
- Product
- WSO2 API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Aug 6, 2026URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors ofCVE-2026-66829 · Other software · rrrene · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbLow 2.3
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv="refresh"> element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied <meta> elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy. This is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
- Product
- html_sanitize_ex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Aug 6, 2026Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and suCVE-2026-65583 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fixes this issue.
- Product
- Apache CXF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 6, 2026The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific mCVE-2025-15039 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Critical 9.4
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.
- Product
- WSO2 Identity Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Aug 6, 2026The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factoCVE-2025-13909 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 4.3
The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable information. Successful exploitation allows an attacker to disclose personally identifiable information of users in different tenants, resulting in privacy violations and potential regulatory non-compliance. This may include unauthorized access to user details such as mobile numbers.
- Product
- WSO2 Identity Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Aug 6, 2026Estatik Real Estate: Does not properly enforce its anti-spam check or restrict the recipient routing of its property request formCVE-2026-14547 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively using the site as a mail relay for spam or phishing.
- Product
- Estatik Real Estate
- Fixed in
- 4.3.3
- What to do
- Update Estatik Real Estate to 4.3.3 or newer.
Aug 5, 2026IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery (SSRF) due to incomplete and ineffective SSRF protection enforcement.CVE-2026-7657 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery (SSRF) due to incomplete and ineffective SSRF protection enforcement.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encrypCVE-2026-17578 · Other software · Kong · reported by 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbLow 2.3
Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate without key rotation, which only occurs on reboot of the Kong Event Gateway instance, the probability of a nonce collision becomes non-negligible. An authorized consumer who detects a nonce collision can recover parts of plaintext from the affected messages. New versions 1.1.2 and 1.2.1 enforce automatic key rotation before the recommended usage limit is reached.
- Product
- Kong Event Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints.CVE-2026-59675 · Other software · SUSE · reported by meissner@suse.deHigh 7.5
When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap (default 1 MiB) is bypassed for requests that pass through the audit copyReqBody path. An unauthenticated attacker can send arbitrarily large request bodies to the public login endpoints, causing the Rancher Manager server process to allocate memory proportional to the supplied body size. With just a few concurrent connections, this can exhaust available memory and terminate the Rancher Manager plane process, making the Rancher API and UI unavailable and interrupting management of all downstream clusters.
- Product
- Rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Aug 5, 2026Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id).CVE-2026-55739 · Other software · crater-invoice · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.3
Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).
- Product
- Crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026User Registration & Membership: Does not enforce the site's registration-disabled settingCVE-2026-16736 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.
- Product
- User Registration & Membership
- Fixed in
- 5.2.6
- What to do
- Update User Registration & Membership to 5.2.6 or newer.
Aug 5, 2026Passster: Does not enforce its category-based content protection on the WordPress REST APICVE-2026-16603 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API.
- Product
- Passster
- Fixed in
- 4.3.6
- What to do
- Update Passster to 4.3.6 or newer.
Aug 5, 2026In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests.CVE-2026-71191 · Other software · OpenStack · reported by MITREMedium 6
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration.
- Product
- Swift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.netopenwall.com
Aug 4, 2026An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that CVE-2026-16793 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.7
An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance.
- Product
- XClarity Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent nCVE-2026-16792 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7
An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.
- Product
- XClarity Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authenticaCVE-2026-63456 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.
- Product
- EdgeConnect SD-WAN Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authenticaCVE-2026-63455 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.
- Product
- EdgeConnect SD-WAN Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 charCVE-2026-18401 · Other software · FasterXML · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 6.9
The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service. The synchronous parser enforces this limit correctly, so the constraint is applied inconsistently depending on which parsing API the application uses. Root cause: the async parsing path in NonBlockingUtf8JsonParserBase and related classes never invokes the number length validation methods. Number parsing methods such as _finishNumberIntegralPart() accumulate digits into the TextBuffer without any length check, then call _valueComplete() to finalize the token. _valueComplete() does not call resetInt() or resetFloat(), which are the methods in ParserBase where validateIntegerLength() and validateFPLength() are performed. Because that validation step is skipped, maxNumberLength is never enforced on the async code path. Impact: an attacker sending a JSON document containing an arbitra
- Product
- jackson-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization.CVE-2026-63248 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.
- Product
- Eclipse Milo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Aug 3, 2026An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl entCVE-2026-67969 · Other software · reported by MITREHigh 7.5
An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl entry.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing ParaCVE-2026-68979 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization was limited to read and write privileges on the Parameter Context itself. As a result of the missing authorization, an authenticated user authorized to modify a Parameter Context, but not authorized on referencing components, could alter Parameter values affecting those components. In deployments where a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation, without starting the referencing component. The impact was limited to stopped components by existing verification checks, and the issue applies only to deployments that use component-level authorization policies. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which aligns the Parameter Context update method authorization with other methods, adding authorization checking on affected components.
- Product
- Apache NiFi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 3, 2026In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforciCVE-2026-12259 · Other software · nltk · reported by security@huntr.devMedium 6.5
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.
- Product
- nltk/nltk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Import and export users and customers: Does not enforce WordPress's role-assignment and per-user edit permissions during CSV importCVE-2026-16534 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.
- Product
- Import and export users and customers
- Fixed in
- 2.4.2
- What to do
- Update Import and export users and customers to 2.4.2 or newer.
Aug 3, 2026In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard.CVE-2026-13506 · Other software · Legion of the Bouncy Castle Inc. · reported by 91579145-5d7b-4cc5-b925-a0262ff19630High 8.7
In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
- Product
- BC-JAVA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption.CVE-2026-12802 · Other software · Legion of the Bouncy Castle Inc. · reported by 91579145-5d7b-4cc5-b925-a0262ff19630High 8.7
In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
- Product
- BC-JAVA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026Simple Restrict: Does not enforce its content-restriction permission check on the REST API the way it does on the front endCVE-2026-15939 · WordPress plugins & themes · reported by WPScanLow 2.7
The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing users with contributor-level access or above to read the content of restricted posts and pages they were never granted access to.
- Product
- Simple Restrict
- Fixed in
- 1.2.9
- What to do
- Update Simple Restrict to 1.2.9 or newer.
Aug 1, 2026ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ...CVE-2026-67344 · Other software · ArcadeData · reported by VulnCheckHigh 8.5
ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access (e.g., a read-only API token) can submit these ALTER TYPE statements via the HTTP command endpoint to mutate a type's custom schema metadata and bucket-selection strategy, bypassing the documented updateSchema permission boundary and potentially corrupting schema metadata and record routing.
- Product
- arcadedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.