Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,444 results · page 18 of 149
Jul 17, 2026JLine is a Java library for handling console input.CVE-2026-56741 · Other software · jline · reported by GitHubHigh 7.5
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
- Product
- jline3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026JLine is a Java library for handling console input.CVE-2026-56740 · Other software · jline · reported by GitHubHigh 7.5
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
- Product
- jline3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.CVE-2026-54335 · Other software · feathersjs · reported by GitHubLow 3.7
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__, constructor, or prototype key, that key is returned as an own-enumerable property; the recursive merge then resolves target['__proto__'] to Object.prototype and writes attacker-supplied properties onto it, polluting the prototype for all plain objects in the process for the lifetime of the Node process. This issue is fixed in version 5.0.45.
- Product
- feathers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.CVE-2026-49485 · Other software · hapifhir · reported by GitHubHigh 7.5
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through an incomplete timeout utility. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting CPU resources and causing denial of service in the FHIR Validator HTTP endpoint and affected org.hl7.fhir.* modules. This issue is fixed in versions 6.9.9 and 6.9.4.2.
- Product
- org.hl7.fhir.core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.CVE-2026-52348 · Other software · reported by MITRECritical 9.8
cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java.CVE-2026-45799 · Other software · square · reported by GitHubHigh 7.5
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03.
- Product
- wire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Symfony UX is a JavaScript ecosystem for Symfony.CVE-2026-49216 · Other software · symfony · reported by GitHubMedium 5.1
Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _createAutocompleteWithRemoteData() by interpolating the text field into HTML template literals (<div>${item[labelField]}</div>) rather than text, allowing attacker-controlled markup from user-supplied dropdown values to execute in the browser of any user who opens an autocomplete widget backed by the same data. This issue is fixed in versions 2.36.0 and 3.1.0.
- Product
- ux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Symfony UX is a JavaScript ecosystem for Symfony.CVE-2026-49215 · Other software · symfony · reported by GitHubLow 2.1
Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventListener\LiveComponentSubscriber::isLiveComponentRequest() gates #[LiveAction] invocations on Accept: application/vnd.live-component+html, but the Accept header is CORS-safelisted and cross-origin fetch() can set it without preflight, allowing forged cross-origin #[LiveAction] requests against a victim session when applications use SameSite=None, credentials: 'include', a permissive cookie policy, or a same-origin pivot. This issue is fixed in versions 2.36.0 and 3.1.0.
- Product
- ux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Symfony UX is a JavaScript ecosystem for Symfony.CVE-2026-49212 · Other software · symfony · reported by GitHubMedium 6.9
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier (props vs propsFromParent), or request context, allowing a signed blob minted for one component or slot to be replayed in another and set a read-only prop on a target component. This issue is fixed in versions 2.36.0 and 3.1.0.
- Product
- ux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Symfony UX is a JavaScript ecosystem for Symfony.CVE-2026-49211 · Other software · symfony · reported by GitHubMedium 6.9
Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards (%, _, \), allowing unauthenticated users to turn the public BaseEntityAutocompleteType endpoint into a broad matcher or blind boolean oracle against every column in default searchable_fields. This issue is fixed in versions 2.36.0 and 3.1.0.
- Product
- ux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Symfony UX is a JavaScript ecosystem for Symfony.CVE-2026-49210 · Other software · symfony · reported by GitHubLow 2.3
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml() interpolates the client-controlled children[id].tag value from LiveComponentSubscriber and InterceptChildComponentRenderSubscriber directly into HTML as a tag name without escaping or validation, allowing arbitrary HTML, including <script> tags, on any Live Component re-render that contains at least one child component. This issue is fixed in versions 2.36.0 and 3.1.0.
- Product
- ux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Symfony UX is a JavaScript ecosystem for Symfony.CVE-2026-49209 · Other software · symfony · reported by GitHubMedium 5.3
Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0.
- Product
- ux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Symfony UX is a JavaScript ecosystem for Symfony.CVE-2026-49208 · Other software · symfony · reported by GitHubMedium 6.9
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue() falls back to new $className($value), allowing client-supplied relative strings such as now, tomorrow, or +10 years to move a writable, format-less date prop past time-based business logic checks. This issue is fixed in versions 2.36.0 and 3.1.0.
- Product
- ux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript oCVE-2026-63397 · Other software · remorses · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.1
remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported.
- Product
- genql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.CVE-2026-45367 · Other software · hapifhir · reported by GitHubHigh 7.5
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.
- Product
- org.hl7.fhir.core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript.CVE-2026-55445 · Other software · whyour · reported by GitHubCritical 9.3
Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.
- Product
- qinglong
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026jadx is a Dex to Java decompiler.CVE-2026-54684 · Other software · skylot · reported by GitHubHigh 7
jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolve(fileName) after a CWD-based ZIP security check. When jadx is launched from a directory that is an ancestor of the config directory, the arbitrary write can plant a JAR in plugins/dropins, and the next jadx run loads the JAR with URLClassLoader and ServiceLoader, executing attacker-controlled plugin code. This issue is fixed in version 1.5.6.
- Product
- jadx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026jadx is a Dex to Java decompiler.CVE-2026-42447 · Other software · skylot · reported by GitHubLow 3.6
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK with an HTML URL-encoded ZIP entry name can force rendering of arbitrary HTML, perform out-of-band requests, disclose the victim IP address, or interact with locally exposed applications. This issue is fixed in version 1.5.6.
- Product
- jadx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026jadx is a Dex to Java decompiler.CVE-2026-42049 · Other software · skylot · reported by GitHubHigh 8.4
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the string context so that opening or building the exported Gradle project executes attacker-controlled Groovy code on the victim machine. This issue is fixed in version 1.5.6.
- Product
- jadx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026sigstore-js provides JavaScript libraries for interacting with Sigstore services.CVE-2026-48816 · Other software · sigstore · reported by GitHubMedium 6.5
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.
- Product
- sigstore-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026sigstore-js provides JavaScript libraries for interacting with Sigstore services.CVE-2026-48815 · Other software · sigstore · reported by GitHubHigh 7.5
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.
- Product
- sigstore-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026sigstore-js provides JavaScript libraries for interacting with Sigstore services.CVE-2026-48758 · Other software · sigstore · reported by GitHubMedium 5.4
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.
- Product
- sigstore-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data.CVE-2026-48125 · Other software · faisalman · reported by GitHubMedium 5.3
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.
- Product
- ua-parser-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.CVE-2026-48069 · Other software · grpc · reported by GitHubHigh 7.5
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
- Product
- grpc-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.CVE-2026-48068 · Other software · grpc · reported by GitHubHigh 7.5
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.
- Product
- grpc-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026joi is a schema description language and data validator for JavaScript.CVE-2026-48038 · Other software · hapijs · reported by GitHubMedium 5.3
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.
- Product
- joi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026sigstore-js provides JavaScript libraries for interacting with Sigstore services.CVE-2026-59891 · Other software · sigstore · reported by GitHubCritical 9.6
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for and transmitted to a different registry whose hostname has a substring relationship with a configured auth key. This issue is fixed in version 0.7.1.
- Product
- sigstore-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated aCVE-2026-57898 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9
In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter and passed it through repository file handling as both a repository key and, during thumbnail retrieval, a local filesystem path. With the MongoDB file repository, the supplied filename was treated as an opaque GridFS key and was not normalized or restricted as a filesystem path. A remote attacker could upload thumbnail content using an absolute or traversal-style filename, then trigger thumbnail retrieval so that the uploaded bytes were written to the attacker-chosen path on the server filesystem. This could allow writing files anywhere the Java process has permission to write and may lead to remote code execution. The default InMemory backend is not affected by this specific path because it normalizes and restricts file paths to its temporary directory. The issue is fixed in Eclipse BaSyx Java Server SDK 2.0.0-milestone-13.
- Product
- Eclipse BaSyx - Java Server SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs.CVE-2026-44752 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.2
SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data displayed in the client�s browser. This results in a high impact on confidentiality, low impact on integrity with no impact on availability of the application.
- Product
- SAP NetWeaver Application Server Java(Configuration Wizard)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions.CVE-2026-55773 · Other software · cedar-policy · reported by GitHubHigh 8.8
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr(). The toCedarExpr() method on Cedar Value types does not escape special characters (" or \) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting || true into a permit ... when { ... } clause could make the permit unconditional, or injecting && false into a forbid clause could prevent the forbid from triggering. This issue requires the integrator to use toCedarExpr() to build policy text at runtime from user-controlled input. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.0.
- Product
- cedar-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions.CVE-2026-55771 · Other software · cedar-policy · reported by GitHubHigh 8.8
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the EntityIdentifier.equals() has inverted null/self branches which could lead to incorrect equality comparisons. The EntityIdentifier.equals() method has inverted logic for null and self-reference checks, returning true for null comparisons and false for self-comparisons. This does not affect Cedar authorization decisions (computed in Rust from JSON), but could affect integrators who perform their own equality checks on entity identifiers. This issue has been fixed in version 4.9.0.
- Product
- cedar-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim'sCVE-2026-58228 · Other software · phoenixframework · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbMedium 5.1
Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.valid_destination!/2 and Phoenix.LiveView.Utils.valid_live_navigation_destination!/2 functions in lib/phoenix_live_view/utils.ex rely on an internal uri_scheme/1 helper that only detects a scheme when the input's first byte is an ASCII letter. Inputs beginning with an ASCII control character or space fall through to a nil-returning clause, causing the URL to be treated as a safe relative path. Standard browsers implement the WHATWG URL parser, which strips leading C0 control and space characters before parsing. As a result, an input such as " javascript:alert(1)" is passed unchanged into <.link href={...}> and, when clicked, is parsed by the browser as a javascript: URL that executes attacker-controlled script in the victim's session. Applications that render user-supplied URLs (for example profile links, redirect targets, or external references) via <.link href={...}> are affected. This issue affects phoenix_live_view: from 1.2.2 before 1.2.7.
- Product
- phoenix_live_view
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Jul 13, 2026CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions.CVE-2026-55772 · Other software · cedar-policy · reported by GitHubHigh 8.8
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy must reference that value in a when/unless clause. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.
- Product
- cedar-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript CVE-2026-49971 · Other software · plank · reported by VulnCheckMedium 5.3
Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. Attackers can store persistent XSS payloads in uploaded SVG files that execute with full DOM access when victims open or preview the file, enabling session cookie theft, CSRF token capture, and account takeover.
- Product
- laravel-mediable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2026luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAPCVE-2026-61875 · Other software · openwrt · reported by VulnCheckHigh 8.7
luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders without output encoding, executing the payload when administrators view the UPnP or Status pages.
- Product
- luci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 11, 2026The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at CVE-2026-61454 · Other software · getgrav · reported by VulnCheckHigh 8.7
The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin (and its subroutes). This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers, allowing an unauthenticated attacker to fingerprint the deployment and select version-specific exploits without reconnaissance.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 10, 2026LangChain4j is a Java library for building LLM-powered applications on the JVM.CVE-2026-55405 · Other software · langchain4j · reported by GitHubHigh 7.6
LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys, and in MariaDB string values, directly into the query without adequate escaping. A crafted metadata key in EmbeddingSearchRequest.filter() can break out of its SQL context and inject arbitrary SQL into the statements executed by the stores' search and removeAll(Filter) operations, enabling blind data exfiltration, denial of service via sleep functions, and deletion of arbitrary rows through removeAll(Filter). This issue is fixed in langchain4j-mariadb and langchain4j-pgvector versions 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26.
- Product
- langchain4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app.CVE-2026-13461 · Other software · PayRange · reported by cret@cert.orgCritical 9.6
When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls allows the attacker to escape the WebView sandbox and perform a number of dangerous actions on the user's device.
- Product
- PayRange
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgkb.cert.org
Jul 8, 2026Symfony UX is a JavaScript ecosystem for Symfony.CVE-2026-55878 · Other software · symfony · reported by GitHubHigh 7.8
Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative() accepts paths like ../../../etc, a crafted or compromised kit can write attacker-controlled content to arbitrary locations or read local files outside the recipe directory. This issue is fixed in versions 2.36.1 and 3.2.0.
- Product
- ux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Symfony UX is a JavaScript ecosystem for Symfony.CVE-2026-55877 · Other software · symfony · reported by GitHubMedium 6.1
Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux_icon() Twig function is marked is_safe=['html'] and Icon::toHtml() inlines SVG source verbatim, allowing unsanitized local SVG files or Iconify on-demand JSON body responses containing nested script elements, on* event handlers, or dangerous URL schemes to execute cross-site scripting. This issue is fixed in versions 2.36.1 and 3.2.0.
- Product
- ux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.CVE-2026-55471 · Other software · hapifhir · reported by GitHubHigh 8.7
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who controls or can tamper with transformed XML to trigger XML External Entity injection for local file disclosure and blind XXE or SSRF to arbitrary URLs reachable from the host. This issue is fixed in version 6.9.10.
- Product
- org.hl7.fhir.core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.CVE-2026-55470 · Other software · hapifhir · reported by GitHubHigh 7.5
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() was updated, allowing an unauthenticated attacker to trigger catastrophic regex backtracking and exhaust server CPU. This issue is fixed in version 6.9.10.
- Product
- org.hl7.fhir.core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026libp2p is a JavaScript Implementation of libp2p networking stack.CVE-2026-49866 · Other software · libp2p · reported by GitHubHigh 7.5
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronously iterate roughly 180,000 message IDs per 4 MB frame and block the Node.js event loop. This issue is fixed in version 16.0.0.
- Product
- js-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Handlebars.java provides logic-less and semantic Mustache templates with Java.CVE-2026-55760 · Other software · jknack · reported by GitHubHigh 7.5
Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compile() using FileTemplateLoader or ClassPathTemplateLoader are vulnerable to path traversal, allowing arbitrary file read through template names derived from URL path parameters, request parameters, or other user-controlled sources. This issue is fixed in version 4.5.2.
- Product
- handlebars.java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.CVE-2026-55575 · Other software · harttle · reported by GitHubHigh 8.2
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filter at src/filters/array.ts allocated a full clone of its input array via [...toArray(v)] without calling this.context.memoryLimit.use(...), allowing a template render such as {{ huge_array | pop }} to allocate an O(N) clone of an attacker-influenced array outside the configured memoryLimit budget. This issue is fixed in version 10.27.1.
- Product
- liquidjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-59897 · Other software · honojs · reported by GitHubMedium 4.8
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-59896 · Other software · honojs · reported by GitHubMedium 6.5
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-59895 · Other software · honojs · reported by GitHubMedium 6.1
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026OpenTelemetry JavaScript is the OpenTelemetry JavaScript client.CVE-2026-59892 · Other software · open-telemetry · reported by GitHubHigh 7.5
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.
- Product
- opentelemetry-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026protobufjs compiles protobuf definitions into JavaScript (JS) functions.CVE-2026-59877 · Other software · protobufjs · reported by GitHubMedium 5.3
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.
- Product
- protobuf.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.