Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
135,451 results · page 2 of 2710
Oct 30, 2026Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing.CVE-2026-114537 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.
- Product
- View Unpublished
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing.CVE-2026-114535 · Websites & servers · Drupal · reported by mlhess@drupal.org
Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.
- Product
- Swiper formatter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing.CVE-2026-114533 · Websites & servers · Drupal · reported by mlhess@drupal.org
Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3.
- Product
- Ágora Transparency Theme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing.CVE-2026-114530 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7.
- Product
- Dopup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation.CVE-2026-107312 · Websites & servers · Drupal · reported by mlhess@drupal.org
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7.
- Product
- Examples for Developers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing.CVE-2026-107311 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.
- Product
- Permissions by Term
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing.CVE-2026-107309 · Websites & servers · Drupal · reported by mlhess@drupal.org
Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.
- Product
- Easy Breadcrumb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing.CVE-2026-107307 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.
- Product
- SmartLinker AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing.CVE-2026-107268 · Websites & servers · Drupal · reported by mlhess@drupal.org
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.
- Product
- Two Factor Authentication - TFA / Passwordless Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing.CVE-2026-107267 · Websites & servers · Drupal · reported by mlhess@drupal.org
Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.
- Product
- DKAN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing.CVE-2026-107266 · Websites & servers · Drupal · reported by mlhess@drupal.org
Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.
- Product
- Views Share
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing.CVE-2026-107263 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.
- Product
- Gutenberg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery.CVE-2026-107262 · Websites & servers · Drupal · reported by mlhess@drupal.org
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.
- Product
- Advanced Filesystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing.CVE-2026-107258 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.
- Product
- Inline Entity Form Dialog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing.CVE-2026-107257 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
- Product
- Actstream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force.CVE-2026-107256 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0.
- Product
- Shield
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing.CVE-2026-107255 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.
- Product
- Restrict route by IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing.CVE-2026-107251 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.
- Product
- Entity Reference Manager (Merge entities)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shaCVE-2026-74915 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ce
A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits on the device.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger an OOB write in the GPU user-space driver, leading to memoryCVE-2026-65587 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ce
A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger an OOB write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash. The software writes data past the end of an intended memory offset. Writing outside the bounds of allocated memory can corrupt adjacent memory, crash the process, or cause undefined behaviour.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and caCVE-2026-65586 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ce
Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages. A memory buffer managed by a CPU thread of control (driver) and accessed by a GPU thread of control (firmware) can be freed while in use. Software installed and run as a non-privileged user may replace that buffer with another and replace a shared resource (memory page address list) managed by the CPU thread of control (driver) leading to the GPU accessing memory not managed by the CPU thread of control (driver).
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can lead memory allocation failure.CVE-2026-18629 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ce
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can lead memory allocation failure. If the allocation failure is not properly handled, the compiler may dereference a NULL pointer at a controlled offset, resulting in a crash of the compiler process. On certain platforms, when the compiler process has system privileges this could lead to crashes or enable further exploits on the device. The weakness results from performing arithmetic operations on values derived from the shader program without properly preventing integer overflow. The overflow can cause incorrect memory size calculations, leading to memory allocation failures and subsequent invalid program behaviour. Integer overflow can produce unexpected values that affect memory allocation and other security-relevant operations.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destCVE-2026-15466 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ce
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decremented in non-atomical way allowing other code paths using a freed object to read and/or write kernel heap memory.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and idCVE-2026-118947 · Other software · Red Hat · reported by Red HatMedium 4.3
A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 29, 2026Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.CVE-2026-92744 · Other software · Delinea · reported by 1443cd92-d354-46d2-9290-d812316ca43aHigh 8.7
Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.
- Product
- Privilege Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam ManagemCVE-2026-107239 · Other software · Veeam · reported by support@hackerone.comHigh 8.8
A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.
- Product
- Management Pack for Microsoft System Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management CVE-2026-107238 · Other software · Veeam · reported by support@hackerone.comHigh 8.7
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.
- Product
- Management Pack for Microsoft System Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of VeCVE-2023-22793 · Other software · Veeam · reported by support@hackerone.comCritical 9.3
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.
- Product
- Management Pack for Microsoft System Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026WeGIA is a web manager for charitable institutions.CVE-2026-61719 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.9
WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuarios.php` arises because the `textoProntuario` field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through `POST /controle/control.php` with `nomeClasse=SaudeControle`, `metodo=alterarProntuario`, and `id_fichamedica`. The stored content is rendered when another user accesses `/html/saude/historico_prontuarios.php` with `id_historico`, automatically executing attacker-controlled JavaScript in the victim's browser. The vulnerability permits session cookie theft and potential account compromise depending on the victim's privileges. This issue is fixed in version 3.8.7.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026WeGIA is a web manager for charitable institutions.CVE-2026-61673 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.3
WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field. The affected flow spans `web/controle/memorando/DespachoControle.php` and `web/dao/memorando/DespachoDAO.php`: `FILTER_SANITIZE_SPECIAL_CHARS` is applied during storage, but `html_entity_decode()` later decodes the stored content and `jQuery .html()` inserts the result into the DOM. An attacker able to submit a memorandum dispatch through `/controle/control.php` using `DespachoControle` and `metodo=incluir` can store malicious HTML or JavaScript. The code executes automatically when another user views the memorandum thread through `/html/memorando/listar_despachos.php` with `id_memorando`. This permits arbitrary JavaScript execution, theft of administrator `PHPSESSID` session tokens, privileged session hijacking, account takeover, and unauthorized access to privileged or internal functionality. This issue is fixed in version 3.8.7.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026WeGIA is a web manager for charitable institutions.CVE-2026-61671 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.1
WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `extract($_REQUEST)`, including id, `idatendido`, `idInterno`, and `id_funcionario`, while the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. `AtendidoControle` lacks ownership checks on alterar, excluir, `listarUm`, `alterarInfPessoal`, `alterarDocumentacao`, `alterarImagem`, `alterarEndereco`, and `alterarStatus`; `InternoControle` lacks them on incluir, alterar, excluir, `listarUm`, `listarTodos`, and `listarCpf`. `FuncionarioControle` lacks ownership checks on `alterarInfPessoal`, `alterarEndereco`, `alterarDocumentacao`, `alterarImagem`, `alterarCargaHoraria`, and excluir; `VoluntarioControle` lacks them on `alterarInfPessoal`, `alterarEndereco`, `alterarDetalhes`, `alterarImagem`, and excluir. `AtendidoControle` and `InternoControle` additionally lack CSRF validat
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Lightdash is an open source business intelligence platform.CVE-2026-61654 · Other software · lightdash · reported by GitHubHigh 8.3
Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered i
- Product
- lightdash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-45049 · Other software · OpenIdentityPlatform · reported by GitHubHigh 8.3
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026GraphQL-core is a Python port of the GraphQL.js reference implementation.CVE-2026-119286 · Other software · graphql-python · reported by GitHubHigh 7.5
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document with more than 100 validation errors to cause unbounded memory growth before query execution, eventually exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1.
- Product
- graphql-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.CVE-2026-115943 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it. An attacker who supplies an XLSX file can run arbitrary Perl code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgopenwall.com
Oct 29, 2026Lightdash is an open source business intelligence platform.CVE-2026-61576 · Other software · lightdash · reported by GitHubHigh 8.3
Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered i
- Product
- lightdash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026the load_popup_content REST endpoint that: Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access controlCVE-2026-119325 · WordPress plugins & themes · reported by VulnCheckHigh 7.5
Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.
- Product
- the load_popup_content REST endpoint that
- What to do
- Update the load_popup_content REST endpoint that to the newest version.
Full record and what to do →NVD recordbricksbuilder.iovulncheck.com
Oct 29, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-119209 · Other software · py-pdf · reported by GitHubHigh 7.1
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-119208 · Other software · py-pdf · reported by GitHubHigh 7.1
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive work and memory use. This issue is fixed in version 6.21.3.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-119207 · Other software · py-pdf · reported by GitHubHigh 7.1
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into very large error messages. This issue is fixed in version 6.21.3.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-119206 · Other software · py-pdf · reported by GitHubHigh 7.1
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-119205 · Other software · py-pdf · reported by GitHubHigh 7.1
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check. This issue is fixed in version 6.21.4.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-119204 · Other software · py-pdf · reported by GitHubHigh 7.1
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, allowing the crafted resource structure to cause disproportionate allocations. This issue is fixed in version 6.21.4.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-119203 · Other software · py-pdf · reported by GitHubHigh 7.1
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating when parsing makes no progress, blocking the processing thread. This issue is fixed in version 6.21.4.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Nuxt is an open-source web development framework for Vue.js.CVE-2026-119201 · Other software · nuxt · reported by GitHubMedium 4.8
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. A client with direct HTTP access to an exposed development server can fetch the file, use deriveSecret() to compute derived secrets such as the default useSession password, and forge session cookies accepted by that development server. The default localhost binding limits remote exposure, cross-origin browser reads are blocked, production builds and development servers with an explicitly configured appSecret are not affected. This issue is fixed in version 4.6.3.
- Product
- nuxt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Nuxt is an open-source web development framework for Vue.js.CVE-2026-119200 · Other software · nuxt · reported by GitHubMedium 6.5
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3.
- Product
- nuxt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Nuxt is an open-source web development framework for Vue.js.CVE-2026-119199 · Other software · nuxt · reported by GitHubMedium 5.9
Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at <buildDir>/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at build time into that bundle, including secrets configured in nuxt.config, and Nuxt 4.6.0 and later also inline the generated development appSecret. The default localhost binding limits remote exposure, production builds and Nitro 3 are not affected, and runtime configuration supplied only through NUXT_* environment variables at server startup is not inlined. This issue is fixed in version 4.6.3.
- Product
- nuxt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Nuxt is an open-source web development framework for Vue.js.CVE-2026-119198 · Other software · nuxt · reported by GitHubMedium 5.9
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that file while building the client error report and returns its contents through the error overlay, development error channel, and terminal report, bypassing Vite's server.fs allow list. The default localhost binding limits remote exposure, cross-origin browser requests are rejected, production builds and Nuxt 3 are not affected, and no browser interaction is required. This issue is fixed in version 4.6.3.
- Product
- nuxt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application.CVE-2026-6877 · Other software · ServiceNow · reported by psirt@servicenow.comMedium 5.3
ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
- Product
- ServiceNow AI Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.servicenow.com
Oct 29, 2026An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6.CVE-2026-42057 · Other software · vtk · reported by talos-cna@cisco.comHigh 7.5
An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- vtk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comvtk.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.