Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,751 results · page 2 of 56
Oct 14, 2026A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JCVE-2026-0316 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comLow 1.1
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS® software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by these vulnerabilities.
- Product
- Cloud NGFW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Oct 14, 2026A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arCVE-2026-0313 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 6.1
A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.
- Product
- Cortex XSOAR OS Query
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Oct 14, 2026Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite ReCVE-2026-60010 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Medium 6.5
Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changing team access. This allows unauthorized changes to which organization teams receive repository access.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 14, 2026VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unCVE-2026-110630 · Other software · venturedrake · reported by VulnCheckHigh 7
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.
- Product
- laravel-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web wCVE-2026-110594 · Other software · MicroPyramid · reported by VulnCheckMedium 6.9
BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern evaluated by _match_condition() during case saves, exhausting workers shared across all tenants.
- Product
- BottleCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator.CVE-2026-86607 · Other software · Hitachi · reported by hirt@hitachi.co.jpMedium 4.3
Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator. This issue affects Hitachi Ops Center Administrator: before 11.0.9-01.
- Product
- Hitachi Ops Center Administrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside theiCVE-2026-63174 · Other software · Omnispace · reported by VulnCheckHigh 8.6
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.
- Product
- Agora Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comagora-project.net
Oct 13, 2026Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying cCVE-2026-63154 · Other software · Omnispace · reported by VulnCheckHigh 8.7
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges.
- Product
- Agora Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comagora-project.net
Oct 13, 2026Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or develoCVE-2026-16753 · Other software · Lowcoder · reported by cret@cert.orgHigh 8.8
Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier.
- Product
- Lowcoder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unCVE-2026-110111 · Other software · vatesfr · reported by VulnCheckHigh 7.7
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.
- Product
- xen-orchestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions.CVE-2026-69227 · Other software · Esri · reported by psirt@esri.comCritical 9.8
A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
- Product
- Portal for ArcGIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network CVE-2026-107918 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Medium 4.3
Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router.This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices.
- Product
- R7300DST
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comnetgear.com
Oct 13, 2026Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local networCVE-2026-107917 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Medium 4.3
Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router. This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices.
- Product
- R7300DST
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comnetgear.com
Oct 13, 2026A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators.CVE-2026-94410 · Other software · Bender · reported by info@cert.vde.comMedium 5.3
A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.
- Product
- Customer&Partner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administratorCVE-2026-109374 · Other software · zitadel · reported by VulnCheckMedium 5.1
ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAM_OWNER by bypassing the admin.impersonation check. Attackers holding IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles can sign in to relying applications as administrators with their roles and claims.
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in CVE-2026-109329 · Other software · Admidio · reported by VulnCheckHigh 8.5
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a foreign role UUID to gain privileged membership, log into that organization, and edit its user profiles.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges tCVE-2026-85956 · Other software · Progress Software Corporation · reported by security@progress.comCritical 9.6
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.
- Product
- MarkLogic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 12, 2026Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code.CVE-2026-103529 · Other software · Thelia · reported by cret@cert.orgMedium 5.4
Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's `install()` method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disCVE-2026-109177 · Other software · moxi624 · reported by VulnCheckMedium 5.3
MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which update rows without admin_uid checks, relocating or renaming other users' files and folders.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files vCVE-2026-109176 · Other software · moxi624 · reported by VulnCheckMedium 5.3
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-dCVE-2026-109175 · Other software · moxi624 · reported by VulnCheckMedium 5.3
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and never by admin_uid, to obtain other administrators' file names and download URLs.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended diCVE-2026-78355 · Other software · OTRS GmbH (former OTRS AG) · reported by security@otrs.comHigh 8.7
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating system file permissions. On OTRS versions prior to OTRS 7, the effective permissions of the web server process are relevant. Starting with OTRS 7, access is limited by the permissions of the dedicated OTRS user. Files with overly permissive ownership or file system permissions may therefore also be affected. The affected functionality may additionally attempt to include controlled files in a support bundle. However, support bundles are sent to a predefined OTRS support address, and direct disclosure of arbitrary files to the attacker has not been demonstrated. An attacker therefore requires valid administrative access to exploit the vulnerable functionality. The primary demonstrated impact is the deletion of files outside the intended directory within the effective permissions of the OTRS application process. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in thCVE-2026-48212 · Other software · OTRS GmbH (former OTRS AG) · reported by security@otrs.comMedium 4.8
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack.CVE-2026-48211 · Other software · OTRS GmbH (former OTRS AG) · reported by security@otrs.comMedium 5.4
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmploCVE-2026-108708 · Other software · WuKongOpenSource · reported by VulnCheckHigh 8.7
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.
- Product
- Wukong_HRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.CVE-2026-45440 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.
- Affected
- up to 9.2
- What to do
- Affects up to 9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.CVE-2026-42722 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.
- Affected
- up to 3.29.13
- What to do
- Affects up to 3.29.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Administrator SQL Injection in Leyka <= 3.32.3 versions.CVE-2026-42717 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Leyka <= 3.32.3 versions.
- Affected
- up to 3.32.3
- What to do
- Affects up to 3.32.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusCVE-2026-108591 · Other software · innocommerce · reported by VulnCheckMedium 5.9
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials.
- Product
- InnoShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.CVE-2026-32645 · Other software · Red Lion Controls · reported by ics-cert@hq.dhs.govCritical 9.2
Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.
- Product
- 700 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenticated administrators to inject SQL via tCVE-2025-71428 · Other software · banq · reported by VulnCheckMedium 6.9
Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents, including other accounts' password hashes.
- Product
- jivejdon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6CVE-2026-104659 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 7.5
Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding. The listener, which is off by default and bound to the loopback when enabled, answered requests whatever their Host header named, and a failed sign-in with the administrator's password from the loopback was neither auto-banned nor delayed. A web page whose host name the attacker rebinds to 127.0.0.1, opened in a browser on the server, can therefore send authenticated requests to the listener, read the answers and try administrator passwords at full speed until one is accepted, giving the attacker full administrative control of the mail server.
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026SMS Alert: Does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbersCVE-2026-94258 · WordPress plugins & themes · reported by WPScanLow 2.7
The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the SMS Alert WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site.
- Product
- SMS Alert
- Fixed in
- 4.0.1
- What to do
- Update SMS Alert to 4.0.1 or newer.
Oct 7, 2026WP Coder: Does not restrict access to its PHP code-execution feature to administratorsCVE-2026-104677 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromise the site.
- Product
- WP Coder
- Fixed in
- 4.5.2
- What to do
- Update WP Coder to 4.5.2 or newer.
Oct 6, 2026A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration.CVE-2026-101156 · Other software · Arista Networks · reported by psirt@arista.comMedium 6.2
A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful exploitation may allow the attacker to act through the victim's authenticated browser session to access sensitive data, modify configurations, or disrupt managed wireless services.
- Product
- CloudVision CUE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based buffer overflow via the /aCVE-2025-71384 · Other software · reported by MITREMedium 6.7
Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordklogixsecurity.comklogixsecurity.com
Oct 5, 2026The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulCVE-2026-59782 · Other software · Zabbix · reported by security@zabbix.comMedium 6.9
The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2026OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realCVE-2026-105121 · Other software · OpenIdentityPlatform · reported by VulnCheckMedium 6.9
OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle to forcibly log out users in any realm.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 3, 2026OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessiCVE-2026-105120 · Other software · OpenIdentityPlatform · reported by VulnCheckMedium 6.9
OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a _queryFilter naming another realm to disclose usernames, universal IDs, and session handles across tenant boundaries.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 2, 2026Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translationCVE-2026-104418 · Other software · TryGhost · reported by VulnCheckHigh 8.6
Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary code on the Ghost server.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 2, 2026Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON CVE-2026-104417 · Other software · TryGhost · reported by VulnCheckMedium 6.9
Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposing server configuration secrets.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 2, 2026DevKit Pro: Authentication Bypass Leading to Administrator Account TakeoverCVE-2026-14378 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the `revert_switch` handler trusting the attacker-controlled `original_user_id` cookie as the privileged identity: `verify_nonce_and_capability()` incorrectly checks the `manage_options` capability on the user identified by the cookie rather than on the actual requester via `current_user_can()`, while the switch-back form and a valid session-bound nonce are emitted publicly via `wp_footer` to any visitor — including unauthenticated users — whenever that cookie is present. This makes it possible for unauthenticated attackers to set the `original_user_id` cookie to any administrator's user ID, collect the rendered nonce, and POST it back to the `revert_switch` handler, causing `wp_set_auth_cookie()` to be called with the administrator's ID and granting the attacker a full administrator-level authenticated session and complete site takeover.
- Product
- DevKit Pro
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update DevKit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.dplugins.comwordfence.com
Oct 1, 2026Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visCVE-2026-34189 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 5.9
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations.CVE-2026-82828 · Other software · Hitachi Industrial Equipment Systems · reported by hirt@hitachi.co.jpHigh 8.7
Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0.
- Product
- Hitachi Coding Software Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges and force the creation of an OCVE-2026-76145 · Other software · Genians, Inc · reported by vuln@krcert.or.krHigh 7.5
An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges and force the creation of an OS account by manipulating the permission column during CSV bulk user registration
- Product
- Genian SSL PNS (frodo-core)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrCVE-2026-102146 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 6.5
An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could be used to alter application files and configuration or to disrupt the availability of the service.
- Product
- Email Protection Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable throCVE-2026-102145 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 6.6
An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only thCVE-2026-102140 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.9
An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the integrity of the imported data.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved withoCVE-2026-102138 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725Low 3.3
An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation requires the licensed gateway role to be active.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on theCVE-2026-102137 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.1
An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.