Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,624 results · page 2 of 73
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not perform any capability checkCVE-2026-94267 · WordPress plugins & themes · reported by WPScanCritical 9
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.
- Product
- Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
- Fixed in
- 0.9.2.8
- What to do
- Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not validate or escape some of its form shortcode attributesCVE-2026-94264 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.
- Product
- Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
- Fixed in
- 0.9.2.8
- What to do
- Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not verify that the requester is authorised to edit the targeted user account in the update-user action of its CVE-2026-94262 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
- Product
- Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
- Fixed in
- 0.9.2.8
- What to do
- Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Oct 22, 2026The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web managemeCVE-2026-109122 · Other software · Kiloview · reported by ics-cert@hq.dhs.govCritical 9.4
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.
- Product
- E3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an uncheckedCVE-2026-115394 · Other software · NationalSecurityAgency · reported by VulnCheckMedium 6.8
Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF packed database file, triggering an OutOfMemoryError in PackedDatabase.open() that aborts the import and denies service.
- Product
- ghidra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as CVE-2026-114653 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.1
A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the stored data — without possession of the encryption keys — can observe the unprotected values.
- Product
- C# Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written withouCVE-2026-114650 · Other software · MongoDB · reported by cna@mongodb.comMedium 6.9
A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer fails to associate the operation with its configured encryption rules and the operation proceeds without an error being raised. An application user with the ability to write data through an affected application can therefore have sensitive fields persisted in plaintext, defeating the confidentiality guarantee that client-side encryption is intended to provide. No integrity or availability impact was observed.
- Product
- C# Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before plaCVE-2026-114648 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.2
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.
- Product
- C# Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operCVE-2026-114647 · Other software · MongoDB · reported by cna@mongodb.comMedium 5.3
The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend.
- Product
- C# Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Link Library: Does not sanitise and escape a link field before outputting it inside an attribute of a link previewCVE-2026-78392 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.
- Product
- Link Library
- Fixed in
- 7.9.6
- What to do
- Update Link Library to 7.9.6 or newer.
Oct 22, 2026WP Ultimate Review: Does not neutralise shortcodes in all of the review fields submitted through its public review formCVE-2026-103234 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.
- Product
- WP Ultimate Review
- Fixed in
- 2.4.5
- What to do
- Update WP Ultimate Review to 2.4.5 or newer.
Oct 21, 2026Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing.CVE-2026-96384 · Websites & servers · reported by mlhess@drupal.orgLow 3.5
Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing.CVE-2026-87955 · Websites & servers · reported by mlhess@drupal.orgMedium 4.3
Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary FCVE-2026-114660 · Other software · getgrav · reported by VulnCheckHigh 7
Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 21, 2026In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractioCVE-2026-76294 · Other software · Splunk · reported by psirt@cisco.comMedium 4.3
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field transformations to apps for which the user does not have read access. The vulnerability is possible because the Representational State Transfer (REST) API does not validate destination app access before it processes field extraction and field transformation move operations. For more information see Use the Field extractions page (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/use-the-settings-pages-for-field-extractions-in-splunk-web/use-the-field-extractions-page) and Manage knowledge object permissions (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/get-started-with-knowledge-objects/manage-knowledge-object-permissions) in the Splunk documentation.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/espi_npcx.c), taking the 12-bit length field directlyCVE-2026-78119 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgMedium 6.3
The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/espi_npcx.c), taking the 12-bit length field directly out of the request header in the FLASHRXBUF FIFO. For write and RPMC OP1 requests it copied DIV_ROUND_UP(len, 4) words into struct espi_taf_pckt.src, a fixed 16-word (64-byte) member of a static structure, without ever comparing the length against that buffer or against the negotiated eSPI receive payload size (rx-plsize, 64 bytes on all in-tree NPCX/NPCK SoCs). Both the loop counter and the word count were uint8_t, so the copy ran up to 255 iterations. An eSPI controller that emits a flash request whose header claims a payload larger than the negotiated maximum therefore drives up to 239 32-bit stores past the end of the structure — roughly 956 bytes of out-of-bounds write into .bss — from the eSPI flash receive interrupt handler, while the source reads walk past the end of the 18-word FLASHRXBUF register array into neighbouring eSPI registers. The same unvalidated length was then passed on to flash_write() in espi_taf_npcx_flash_write() with the 64-byte src buffer as source, reading up to 4 KB of adjacent controller SRAM
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte codec_ie[] array.CVE-2026-18748 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgLow 3.5
The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte codec_ie[] array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dp_process_config_ind() in subsys/bluetooth/host/classic/a2dp.c copied only the first 8 bytes but assigned the full, attacker-chosen length to len, and then persisted that inconsistent structure into the application's struct bt_a2dp_stream via stream->codec_config. bt_a2dp_get_config_cb() and bt_a2dp_set_config_cb() had the same truncate-the-copy-but-keep-the-length pattern. Every later consumer trusts len. In particular the responder for an incoming AVDTP GET_CONFIGURATION, a2dp_get_config_ind(), executes net_buf_add_mem(rsp_buf, &ep->stream->codec_config.codec_ie[0], ep->stream->codec_config.len), so a paired BR/EDR peer that first sends a SET_CONFIGURATION carrying an oversized codec IE and then requests the configuration back causes the stack to read up to roughly 245 bytes past the end of the 8-byte array and transmit them in the response. codec_config is the last member of struct bt_a2dp_stream, so the read runs into memory adjacent to the application's stream o
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and ECVE-2026-102486 · Other software · NTPsec · reported by cve@gitlab.comHigh 7.5
Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.
- Product
- ntpsec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) vCVE-2025-60492 · Other software · reported by MITREMedium 5.5
A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and CVE-2026-111075 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote attacker can send a crafted network payload that triggers an unsigned integer underflow in `DataDescriptor::getPayloadSize()` and `DataDescriptor::getNextDescriptor()`. This results in an out-of-bounds heap read and an immediate process crash (SIGSEGV), causing a denial of service.
- Product
- Eclipse OpenJ9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 20, 2026Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: Smart Answer).CVE-2026-91433 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.2
Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: Smart Answer). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel Apps - Field Service. Successful attacks of this vulnerability can result in takeover of Siebel Apps - Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
- Product
- Siebel Apps - Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).CVE-2026-101694 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.2
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).CVE-2026-101692 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-101675 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.7
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Mobile Field Service executes to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-101674 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.7
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Mobile Field Service executes to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).CVE-2026-101665 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-101664 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).CVE-2026-101662 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as unauthorized read access to a subset of Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).CVE-2026-101661 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.4
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).CVE-2026-101660 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).CVE-2026-101658 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.4
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-101656 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-101655 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-101654 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-101653 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-101644 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.6
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).CVE-2026-101636 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.4
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-101635 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-101634 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.1
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Field Service. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
- Product
- Oracle Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields).CVE-2026-101552 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Application Object Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing.CVE-2026-110322 · Other software · HMS Networks · reported by ics-cert@hq.dhs.govMedium 6.8
The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing.
- Product
- PEAK-System Device Driver Setup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section.CVE-2026-93003 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing decisions it should not be able to reach.
- Product
- Eclipse ThreadX - NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the uniqueCVE-2026-113359 · Other software · Baserow · reported by VulnCheckMedium 5.3
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.
- Product
- Baserow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Meta Box – WordPress Custom Fields Framework: Missing AuthorizationCVE-2026-109700 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2.
- Product
- Meta Box – WordPress Custom Fields Framework
- Affected
- up to 5.15.2
- What to do
- Affects up to 5.15.2. Update Meta Box – WordPress Custom Fields Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry onCVE-2026-92446 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.8
`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more data than it contains is read past its end, and an offset stored in the file is turned into a pointer without being bounded. This is a distinct defect from GHSA-hgcj-22cg-4hfv, which was an underflowed glyph count. It needs no underflow and no wrapped multiply: a perfectly well-formed, narrow glyph range reaches it.
- Product
- Eclipse ThreadX - GUIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header.CVE-2026-96406 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 4.9
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the configuration descriptor actually received. A device that reports a `wTotalLength` larger than the descriptors it supplies therefore had its own claim believed. Once the real bytes ran out the walk kept going, dereferencing the cursor past the end of the configuration buffer, in the host's context, whenever the application queried format or frame data.
- Product
- Eclipse ThreadX - USBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record.CVE-2026-112239 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 7.2
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
- Product
- Extension "TYPO3 AI Integration Extension"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating CVE-2026-112769 · Other software · parse-community · reported by VulnCheckLow 2.3
Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/_Session to create additional sessions for that user and add fields to _Session; these sessions are not revoked when the original session is logged out.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 19, 2026IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe oCVE-2026-12343 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations.
- Product
- MQ Operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service.CVE-2026-103038 · Other software · StreamSoft · reported by help@fluidattacks.comHigh 8.6
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.
- Product
- PingTools Network Utilities
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.complay.google.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.