Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,415 results · page 18 of 129
Sep 5, 2026WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supCVE-2026-86189 · Other software · WWBN · reported by VulnCheckCritical 9.3
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 5, 2026AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commandsCVE-2026-86124 · Other software · HKUDS · reported by VulnCheckCritical 9.3
AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining access to bind-mounted host workspace directories.
- Product
- AutoAgent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attackCVE-2026-86123 · Other software · sqlchat · reported by VulnCheckCritical 9.4
SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's network without authentication.
- Product
- sqlchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026Contact Form by Supsystic: Stored Cross-Site ScriptingCVE-2026-83625 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can first call the 'updateNonce' action — which is accessible without authentication due to its absence from the plugin's permission list — to obtain a valid nonce, then submit a contact form with a malicious payload in a spoofed IP header such as X-Forwarded-For.
- Product
- Contact Form by Supsystic
- Affected
- up to 1.10.2
- What to do
- Affects up to 1.10.2. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026Video Player for YouTube: Does not properly sanitise and escape user-supplied input before using it in a SQL statementCVE-2026-84937 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database.
- Product
- Video Player for YouTube
- Fixed in
- 2.1.0
- What to do
- Update Video Player for YouTube to 2.1.0 or newer.
Sep 5, 2026Kirki: Does not escape a user-supplied identifier before using it in a SQL queryCVE-2026-84221 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.
- Product
- Kirki
- Fixed in
- 6.3.0
- What to do
- Update Kirki to 6.3.0 or newer.
Sep 5, 2026Greenshift: Does not validate a user-supplied URL before fetching it server-sideCVE-2026-83543 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response.
- Product
- Greenshift
- Fixed in
- 13.2.0
- What to do
- Update Greenshift to 13.2.0 or newer.
Sep 5, 2026Accept Stripe Payments: Does not validate a user-supplied URL before using it in a redirectCVE-2026-81423 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing.
- Product
- Accept Stripe Payments
- Fixed in
- 2.1.4
- What to do
- Update Accept Stripe Payments to 2.1.4 or newer.
Sep 5, 2026SEO Flow by LupsOnline: Does not correctly validate the credential supplied with its API requestsCVE-2026-78362 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.
- Product
- SEO Flow by LupsOnline
- Fixed in
- 3.0.3
- What to do
- Update SEO Flow by LupsOnline to 3.0.3 or newer.
Sep 4, 2026ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer bouCVE-2026-86098 · Other software · ntop · reported by VulnCheckHigh 8.3
ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.
- Product
- nDPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Properly support implicit ODP rereg_mr Due to all the child mkeys in the implicitCVE-2026-80880 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Properly support implicit ODP rereg_mr Due to all the child mkeys in the implicit ODP configuration we cannot change anything in place for the parent mkey. Instead the whole thing needs to be rebuilt if any change is requested. If the user does not specify a translation then force the implicit values which will then fall through the logic into mlx5_ib_reg_user_mr() to allocate a completely new MR. Since implicit children were also touching the mr->pd, this removes another case where the access was racy.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 4, 2026IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.CVE-2026-18221 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SCVE-2026-80765 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsc_on_receive_device_info() trusts bLength and wDescriptorLength without checking that the received packet contains both byte ranges. A malformed host or backend message can therefore make the guest read past the received VMBus packet while copying the report descriptor. Pass the received initial-device-info size into the parser and reject descriptor lengths that exceed the packet. Impact: A malicious Hyper-V host or backend can crash a guest by sending a short initial device-info message with an oversized HID report descriptor length.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 4, 2026MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-sidCVE-2026-85691 · Other software · The-Vibe-Company · reported by VulnCheckHigh 8.7
MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON response.
- Product
- megaparse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that fetches caller-supplied URLs withCVE-2026-85675 · Other software · camel-ai · reported by VulnCheckHigh 8.7
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources, with responses returned to the agent context.
- Product
- owl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied CVE-2026-85624 · Other software · blinkospace · reported by VulnCheckHigh 7.1
Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes including attachments and tags.
- Product
- blinko
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Griffin Hive MetastCVE-2026-52691 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Griffin Hive Metastore Module. This issue affects Apache Griffin Hive Metastore Module: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Apache Griffin Hive Metastore Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 4, 2026Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabledCVE-2026-85616 · Other software · grokability · reported by VulnCheckHigh 8.4
Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for acceptances belonging to other companies by exploiting a null check on the legacy users.company_id column.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 4, 2026E-cab Taxi Booking Manager for Woocommerce: Does not validate a client-supplied trip distance and base-price value on the server before pricing a bookingCVE-2026-84045 · WordPress plugins & themes · reported by WPScanMedium 5.3
The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.
- Product
- E-cab Taxi Booking Manager for Woocommerce
- Fixed in
- 2.0.5
- What to do
- Update E-cab Taxi Booking Manager for Woocommerce to 2.0.5 or newer.
Sep 4, 2026** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster CVE-2026-85229 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI. This issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0. Users are recommended to upgrade to Horizon UI 1.0.0, which fixes the issue.
- Product
- Apache SkyWalking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Xpro Addons — 140+ Widgets for Elementor: Does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifierCVE-2026-84146 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).
- Product
- Xpro Addons — 140+ Widgets for Elementor
- Fixed in
- 1.7.8
- What to do
- Update Xpro Addons — 140+ Widgets for Elementor to 1.7.8 or newer.
Sep 4, 2026WPvivid — Backup, Migration & Staging: Does not validate a user supplied path before using it in a file deletion routineCVE-2026-82194 · WordPress plugins & themes · reported by WPScanMedium 5.5
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.
- Product
- WPvivid — Backup, Migration & Staging
- Fixed in
- 0.9.134
- What to do
- Update WPvivid — Backup, Migration & Staging to 0.9.134 or newer.
Sep 4, 2026WPvivid — Backup, Migration & Staging: Does not validate a user supplied file name before using it to build a write pathCVE-2026-82193 · WordPress plugins & themes · reported by WPScanMedium 5.5
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.
- Product
- WPvivid — Backup, Migration & Staging
- Fixed in
- 0.9.134
- What to do
- Update WPvivid — Backup, Migration & Staging to 0.9.134 or newer.
Sep 3, 2026There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data.CVE-2026-64200 · Other software · measX · reported by security@ni.comHigh 8.5
There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a past the end of an allocated heap buffer during string conversion. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
- Product
- DASYLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data.CVE-2026-64199 · Other software · measX · reported by security@ni.comHigh 8.6
There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read outside the bounds of an allocated data structure. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
- Product
- DASYLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data.CVE-2026-64198 · Other software · measX · reported by security@ni.comHigh 8.5
There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a few bytes past the end of an allocated heap buffer during file handling. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
- Product
- DASYLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated datCVE-2026-64197 · Other software · measX · reported by security@ni.comHigh 8.5
There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated data structure. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
- Product
- DASYLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated heaCVE-2026-64196 · Other software · measX · reported by security@ni.comHigh 8.5
There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated heap. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
- Product
- DASYLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026There is an out-of-bounds write vulnerability in DASYLab due to lack of proper validation of user-supplied data.CVE-2026-64195 · Other software · measX · reported by security@ni.comHigh 8.5
There is an out-of-bounds write vulnerability in DASYLab due to lack of proper validation of user-supplied data. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
- Product
- DASYLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.53.2.0.CVE-2026-15431 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.3
A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.53.2.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls.
- Product
- HP Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a CVE-2026-84968 · Other software · MongoDB · reported by cna@mongodb.comMedium 6.9
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.
- Product
- PHP Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Ultimate Maps by Supsystic: Missing AuthorizationCVE-2026-85309 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3.
- Product
- Ultimate Maps by Supsystic
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Ultimate Maps by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026OpenList a file list program that supports multiple storage.CVE-2026-75602 · Other software · OpenListTeam · reported by GitHubMedium 6.5
OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the user's destination storage. The temporary filename comes from the attacker-controlled Content-Disposition header, is passed from parseFilenameFromContentDisposition in internal/offline_download/http/util.go to filepath.Join(task.TempDir, filename) in SimpleHttp.Run in internal/offline_download/http/client.go, and is opened with os.Create without a containment check. Because filepath.Join cleans .. segments, a non-admin user with PermAddOfflineDownload on any path can traverse out of task.TempDir and create, truncate, or overwrite any file writable by the OpenList process whose parent directory already exists. The server/handles/offline_download.go AddOfflineDownload route uses normal user authentication rather than AuthAdmin, and local-storage destinations fall through tryPutUrl in internal/offline_download/tool/add.go to the vulnerable SimpleHttp.Run path. This issue is fixed in version 4.2
- Product
- OpenList
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentialCVE-2026-85216 · Other software · misp · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Critical 9.5
MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate implementation but did not replicate its credential validation checks. As a result, empty or non-string values could reach the underlying authentication mechanisms. In the LDAP authentication path, an attacker able to identify a valid directory user's email address could submit an empty password. The empty credential could be passed to ldap_bind(), where an LDAP server accepting unauthenticated binds may return a successful result for a valid distinguished name combined with an empty password. MISP could consequently treat the attacker as the corresponding authenticated directory user without verification of the user's password. The issue also affected the LinOTP authentication component. Invalid credential types were not rejected before being processed, and when mixed authentication was enabled, an empty password could be checked against a locally stored MISP password hash. LDAP-provisioned MISP accounts could additionally
- Product
- misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID CVE-2026-85214 · Other software · lenve · reported by VulnCheckHigh 7.2
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.
- Product
- vhr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026The administrative operations within the Carbon Console do not adequately validate specific user-supplied input.CVE-2025-12737 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8High 8.4
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
- Product
- WSO2 Open Banking AM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Sep 3, 2026A NULL pointer dereference flaw was found in GStreamer's RTSP support library.CVE-2026-85150 · Other software · Red Hat · reported by Red HatHigh 7.5
A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 3, 2026LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing uCVE-2026-85092 · Other software · jtsylve · reported by VulnCheckMedium 5.2
LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link with the expected filename pointing to any root-owned file, and when the acquisition runs in kernel context, LiME follows the link and truncates the target file with the memory acquisition stream.
- Product
- LiME
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 3, 2026In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path In nft_flow_rCVE-2026-80744 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path In nft_flow_rule_offload_abort(), WARN_ON_ONCE(err) is triggered on every error during rollback, including -ENOMEM. Memory allocation failures are expected under low-memory conditions and do not indicate a kernel bug. Trace for example: nft_flow_offload_chain() // FLOW_BLOCK_BIND nft_flow_block_chain() nft_chain_offload_cmd() nft_block_offload_cmd() ->ndo_setup_tc() nsim_setup_tc() flow_block_cb_setup_simple() flow_block_cb_alloc() // fails to -ENOMEM The warning was reproduced on the 5.10 stable kernel under memory pressure via fault injection, but the underlying bug exists in mainline as well, as demonstrated by the ENOMEM trace above. The following splat was triggered during nf_tables transaction processing: WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline] WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offlo
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 2, 2026RegistrationMagic: Does not validate a client-supplied quantity multiplierCVE-2026-77794 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants.
- Product
- RegistrationMagic
- Fixed in
- 6.0.9.9
- What to do
- Update RegistrationMagic to 6.0.9.9 or newer.
Sep 2, 2026Ajaxify Comments: Is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied dataCVE-2026-2811 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers.
- Product
- Ajaxify Comments
- Fixed in
- 3.2
- What to do
- Update Ajaxify Comments to 3.2 or newer.
Sep 2, 2026Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied.CVE-2026-84794 · Other software · craftcms · reported by VulnCheckHigh 7.1
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 2, 2026In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence whCVE-2026-18672 · Other software · Progress Software · reported by security@progress.comHigh 7.5
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.
- Product
- Telerik UI for ASP.NET AJAX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definitionCVE-2026-84175 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.3
In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and without a hop limit. An authenticated user who is permitted to create a Thing, or who holds WRITE permission on an existing Thing, can thereby cause the Things service to issue arbitrary HTTP GET requests from inside the deployment's network — including to cloud instance-metadata endpoints and other internal services — and can use the differing error responses returned to the caller to enumerate internal services. Versions 2.4.0 to 2.5.x contain the same code, but are only affected where the operator explicitly enabled the WoT integration feature toggle, which is disabled by default in those versions.
- Product
- Eclipse Ditto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Sep 2, 2026WPvivid — Backup, Migration & Staging: Does not sanitise a user supplied list of identifiers before using it in a SQL queryCVE-2026-82182 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks.
- Product
- WPvivid — Backup, Migration & Staging
- Fixed in
- 0.9.133
- What to do
- Update WPvivid — Backup, Migration & Staging to 0.9.133 or newer.
Sep 2, 2026WC Vendors: Does not verify ownership or the object type of user-supplied IDsCVE-2026-81428 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitrary posts, via IDOR.
- Product
- WC Vendors
- Fixed in
- 2.7.2.1
- What to do
- Update WC Vendors to 2.7.2.1 or newer.
Sep 2, 2026User Frontend: Does not prevent user-supplied field values from being deserializedCVE-2026-19116 · WordPress plugins & themes · reported by WPScanHigh 8.8
The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead to remote code execution when a suitable gadget chain is present on the site.
- Product
- User Frontend
- Fixed in
- 4.3.11
- What to do
- Update User Frontend to 4.3.11 or newer.
Sep 1, 2026PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplied sized allocation.CVE-2026-84698 · Other software · PX4 · reported by VulnCheckHigh 7.1
PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sd_bench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the system.
- Product
- PX4-Autopilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header.CVE-2026-84479 · Other software · WWBN · reported by VulnCheckCritical 9.3
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 1, 2026Laravel Excel provides supercharged Excel exports and imports in Laravel.CVE-2026-84374 · Other software · SpartnerNL · reported by GitHubHigh 7.5
Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves the caller-controlled $destination supplied through Excel::store(), $export->store(), or storeExcel() against the process working directory with realpath() instead of the configured filesystem disk. If the path names an existing writable file, Disk::copy() opens it with fopen() in rb+ mode and uses stream_copy_to_stream(), bypassing Flysystem path confinement and allowing an attacker whose application input controls the export path to overwrite arbitrary existing files with export content. The rb+ behavior creates a non-truncating overwrite and trailing bytes when the new export is shorter, and overwriting an executable PHP file can lead to remote code execution. This issue is fixed in version 3.1.70.
- Product
- Laravel-Excel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.