Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
713 results · page 2 of 15
Jul 10, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS.CVE-2026-10770 · Websites & servers · reported by mlhess@drupal.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2026PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on thCVE-2026-12194 · Websites & servers · phpipam · reported by ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4aLow 2.3
PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on the web server's file system. The API is not enabled by default on installations.
- Product
- phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comprojectblack.io
Jul 2, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows StCVE-2026-13376 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 4.8
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-1071. This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.watchguard.comwatchguard.com
Jun 26, 2026In the Linux kernel, the following vulnerability has been resolved: arm_mpam: Check whether the config array is allocated before destroying it __destroy_compoCVE-2026-53278 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: arm_mpam: Check whether the config array is allocated before destroying it __destroy_component_cfg() is called to free the configuration array. It uses the embedded 'garbage' structure, which means the array has to be allocated. If __destroy_component_cfg() is called from mpam_disable() before the configuration was ever allocated, then a NULL pointer is dereferenced. Check for this case and return early if the configuration is not allocated. __destroy_component_cfg() also frees the mbwu_state as this is allocated by __allocate_component_cfg(). As the mbwu_state is allocated after comp->cfg is set, and is also under mpam_list_lock, only the first pointer needs checking.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 25, 2026Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGrouCVE-2026-12755 · Other software · Devolutions · reported by security@devolutions.netLow 2.7
Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-48983 · Other software · mcdope · reported by GitHubMedium 5.8
pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, a symlink race condition exists in per-device and per-user pad directory creation. pam_usb uses a check-then-act pattern: it calls lstat() to test for existence and then calls mkdir() separately to create the directory. A local attacker can win the race between these calls by replacing the target path with a symlink to a directory they control. If successful, one-time pad files may be written to an attacker-controlled location, potentially exposing future pad values before use or disrupting authentication. This issue has been fixed in version 0.9.2.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-48982 · Other software · mcdope · reported by GitHubMedium 5.8
pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, when updating a one-time pad file, a temporary file is created using open() without the O_EXCL flag. Without O_EXCL, the create operation is not atomic: two concurrent processes racing to update the same pad may both succeed in opening the file, with the second write silently overwriting the first. The one-time pad is the core replay-prevention mechanism of pam_usb. A successful race could result in the stored pad value diverging from what either process expected, potentially causing authentication failures or, in a precisely timed attack, creating a window for pad reuse. This issue has been fixed in version 0.9.2.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-48981 · Other software · mcdope · reported by GitHubMedium 6.7
pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, pam_usb calls xmlReadFile() with flags=0 when loading the configuration file, allowing libxml2 to process external entity references (XXE), potentially making outbound network connections or local file reads at XML parse time from the context of the authenticating process. The vulnerability requires the configuration file to contain crafted XML entity references. Since pam_usb.conf is root-owned, direct exploitation requires prior write access to the config, but the defence-in-depth impact is significant given that pam_usb.so runs in setuid contexts (sudo, su). This issue has been fixed in version 0.9.2.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026pam_usb provides hardware authentication for Linux using removable media.CVE-2026-48980 · Other software · mcdope · reported by GitHubMedium 6.3
pam_usb provides hardware authentication for Linux using removable media. In versions prior to 0.9.2, getenv() environment variables XRDP_SESSION, DISPLAY and TMUX allow environment variable injection into local-check logic. These environment variables influence whether a current session is local or remote, and a PAM module that runs in the context of setuid binaries (sudo, su), getenv() returns attacker-controlled values whenever the process environment has been manipulated by a local user. This issue has been fixed in version 0.9.2.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026pam_usb provides hardware authentication for Linux using removable media.CVE-2026-48986 · Other software · mcdope · reported by GitHubMedium 4.7
pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 and earlier, usb_get_process_parent_id() can cause an infinite loop DoS because it does not initialize *ppid on failure. In pusb_local_login(), the same variable is reused as input and output in a process-tree while loop; if /proc/<pid>/stat cannot be read (for example, when an ancestor process exits during authentication), the PID is not updated and the loop does not terminate. This hangs the authenticating process (such as sudo, sshd, or login) until it is forcibly terminated. This issue has been fixed in version 0.9.2.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-48985 · Other software · mcdope · reported by GitHubMedium 5.5
pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_loginctl_local() can cause a NULL dereference crash when parsing loginctl output. The function calls popen() and reads the result; if the Remote field is only a newline, fgets() succeeds but strtok_r(buf, "\n", &saveptr) returns NULL. A subsequent strcmp(is_remote, "no") then dereferences NULL, causing undefined behavior (typically SIGSEGV) and crashing the PAM module. This can crash the authenticating process (e.g., sudo, login) and, depending on PAM stack configuration, deny access for all users of the affected service. This issue has been fixed in version 0.9.2.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-48984 · Other software · mcdope · reported by GitHubMedium 4.7
pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, the xfree() memory release helper in calls free() without first zeroing the buffer contents, releasing heap-allocated buffers containing sensitive data — including one-time pad bytes read from disk — without clearing, leaving the sensitive content in freed heap memory until it happens to be overwritten by a subsequent allocation. On a system where a use-after-free condition exists, or where a heap inspection primitive becomes available, this could allow recovery of pad values or other authentication material from freed memory regions. This is a defence-in-depth requirement consistent with prior hardening work in this codebase (GHSA-vx6f-rrqr-j87c applied explicit_bzero to some pad paths; this issue generalises the pattern to the central deallocation helper).
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions.CVE-2026-39433 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 16, 2026Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery CVE-2026-11890 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results.
- Product
- Devolutions Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions.CVE-2026-48876 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions.
- Affected
- up to 2026.3
- What to do
- Affects up to 2026.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2026Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/CVE-2026-54411 · Computers, phones & browsers · Linux-PAM · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 6.9
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.
- Product
- Linux-PAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Jun 12, 2026IPAM is the IP address Manager for Cluster API Provider Metal3.CVE-2026-47190 · Other software · metal3-io · reported by GitHubMedium 4.4
IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. This issue has been patched in versions 1.11.7, 1.12.4, and 1.13.0.
- Product
- ip-address-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability.CVE-2026-45169 · Other software · CyberArk Software, a Palo Alto Networks Company · reported by psirt@paloaltonetworks.comHigh 8.7
Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability. Under specific circumstances and configuration scenarios, processing unexpected input could potentially lead to an unexpected service termination, resulting in a localized denial of service (DoS). CyberArk Security Bulletin: CA26-17
- Product
- PAM SH Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cyberark.comdocs.cyberark.com
Jun 11, 2026Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be CVE-2026-45170 · Other software · CyberArk Software, a Palo Alto Networks Company · reported by psirt@paloaltonetworks.comHigh 7.5
Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be fully enforced. CyberArk Security Bulletin: CA26-17
- Product
- Vendor PAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, loCVE-2026-45172 · Other software · CyberArk Software, a Palo Alto Networks Company · reported by psirt@paloaltonetworks.comHigh 8.7
Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host. CyberArk Security Bulletins: CA26-17 and CA26-18
- Product
- PAM Self-Hosted, Privilege Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cyberark.comdocs.cyberark.com
Jun 10, 2026Anti-Spam by CleanTalk. Spam protection: Does not properly sanitize content within a custom shortcode used in its email-encoding featureCVE-2026-8071 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.
- Product
- Anti-Spam by CleanTalk. Spam protection
- Fixed in
- 6.79
- What to do
- Update Anti-Spam by CleanTalk. Spam protection to 6.79 or newer.
Jun 8, 2026Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with wriCVE-2026-10544 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative priCVE-2026-9522 · Other software · Devolutions · reported by security@devolutions.netMedium 5.4
Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses.CVE-2026-47329 · Other software · Canonical · reported by security@ubuntu.comLow 3.3
Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses.
- Product
- Ubuntu Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegatinCVE-2026-41185 · Other software · Tigera · reported by psirt@tigera.ioMedium 6
When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegating to the IPAM plugin. After mutating, the Azure IPAM helper logs the entire unmarshaled configuration map (stdinData) at INFO level to /var/log/calico/cni/cni.log on every CNI ADD and DEL invocation — once per pod scheduled or terminated on the node. When the cluster is deployed using token-based Kubernetes authentication, this log entry contains the ServiceAccount token, client key, and certificate authority in plaintext. Any principal with read access to /var/log/calico/cni/cni.log on a node can read these logs and extract the credentials, which grant cluster-wide Calico networking admin privileges.
- Product
- Calico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-47270 · Other software · mcdope · reported by GitHubMedium 6.3
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb is a PAM module loaded into the host process (sudo, login, GDM, GNOME Shell). Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the deny_remote feature called the non-reentrant strtok(), which stores state in a single global pointer. If two authentications race, one thread's strtok() call can overwrite the other's in-progress tokenisation pointer, causing incorrect parsing of the tmux session data or the /proc environ scan that backs the remote-session detection logic. Additionally, pusb_tmux_get_client_tty() passed the raw pointer returned by getenv(TMUX) directly to strtok(). getenv() returns a pointer into the live process environment block; strtok() inserts NUL bytes into that block, permanently corrupting the TMUX variable for subsequent code running in the same process. In long-lived display managers this affects all future authentications in that process. The combined effect can cause deny_remote=true to return an incorrect decision for a remote session, or an incorrect decision for a local session, depending on thread
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-47269 · Other software · mcdope · reported by GitHubHigh 7.4
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb's deny_remote feature checks utmpx ut_addr_v6 to detect whether an authentication request originates from a remote session. The outer guard was if (utent->ut_addr_v6[0] != 0), which only tests the first 32-bit word of the 128-bit address field. IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) store the IPv4 address in ut_addr_v6[3] with ut_addr_v6[0] == 0. On systems where the SSH daemon listens on :: (IPv6 wildcard) with AddressFamily any -- common on Ubuntu and Debian -- incoming IPv4 connections are recorded in utmpx as IPv4-mapped IPv6 addresses. The outer check evaluates to false, the remote-detection block is skipped entirely, and the session is treated as local. deny_remote=true does not block the authentication. An attacker with physical access to a registered USB device can authenticate over SSH on an affected system as if they were sitting at a local terminal, bypassing the deny_remote restriction. This vulnerability is fixed in 0.9.0.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-44713 · Other software · mcdope · reported by GitHubHigh 8.8
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, splits it on commas, and interpolates the socket-path component directly into a shell command passed to popen(). Because the value is placed inside double-quotes without sanitisation, any value containing " terminates the quoted string and injects arbitrary shell syntax. popen() runs as root inside the PAM stack. This vulnerability is fixed in 0.8.7.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-44712 · Other software · mcdope · reported by GitHubHigh 8.2
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, a crafted UUID such as $(id>/tmp/rce) in the config causes root RCE when pamusb-conf --reset-pads is run. A USB device with a crafted filesystem UUID (some controllers allow this) can inject the payload at --add-device time. Also, userName from the XML config is passed to os.system() in pamusb-agent, which invokes a shell. This vulnerability is fixed in 0.8.7.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-44711 · Other software · mcdope · reported by GitHubHigh 7.9
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authentication bypass and root file corruption. This vulnerability is fixed in 0.8.7.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-44710 · Other software · mcdope · reported by GitHubMedium 4.6
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model() directly to strcmp() without NULL checks. The GIO/UDisks API documentation states these accessors can return NULL for devices that do not expose the corresponding field. Passing NULL to strcmp() is undefined behaviour (typically a SIGSEGV). This vulnerability is fixed in 0.8.7.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-44709 · Other software · mcdope · reported by GitHubHigh 7.8
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, pamusb-pinentry reads the PINENTRY_FALLBACK_APP environment variable and executes it directly without any validation. Any process that can set environment variables before pamusb-pinentry is invoked can point PINENTRY_FALLBACK_APP at an arbitrary binary or script and have it executed with the privileges of the pam_usb tool chain. This vulnerability is fixed in 0.8.7.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-48792 · Other software · mcdope · reported by GitHubMedium 4.4
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/evdev.c silently ignores EACCES errors when opening /dev/input/event* nodes, causing pusb_has_virtual_input_device() to return 0 (no virtual devices found) even when every open() call failed due to insufficient permissions. The caller in src/local.c cannot distinguish a clean absence of virtual devices from a permission-denied scan, and acts on the false negative by continuing authentication without denying. This vulnerability is fixed in 0.9.1.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-48066 · Other software · mcdope · reported by GitHubMedium 5.7
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/log.c contains a process-wide static pointer that is written on every PAM invocation with the address of a stack-local variable. This violates the PAM re-entrancy requirement and creates a data race when the PAM stack is invoked concurrently from multiple threads. This vulnerability is fixed in 0.9.1.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-48065 · Other software · mcdope · reported by GitHubMedium 6.7
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/conf.c allocates heap memory proportional to n_devices, a count derived from libxml2 XPath evaluation of the config file, without first enforcing an upper bound. On 32-bit targets (armv7l, i686 -- both listed in the project Makefile), the multiplication n_devices * sizeof(t_pusb_device) wraps around size_t, causing xmalloc() to receive a very small size. Because xmalloc() only calls abort() on NULL return, a small-but-non-NULL allocation is accepted, and subsequent array writes overflow the heap. This vulnerability is fixed in 0.9.1.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-48064 · Other software · mcdope · reported by GitHubHigh 8.1
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is configured with deny_remote=false in pam_usb (commonly done for display managers such as gdm-password or lightdm to bypass process/TTY heuristics for local sessions), the PAM_RHOST check in pusb_do_auth() is also skipped. PAM_RHOST is set by remote daemons (sshd, XDMCP servers) to identify the remote client address. Because the check is gated inside if (opts.deny_remote), a genuine remote XDMCP connection reaches the USB device authentication step instead of being rejected. This vulnerability is fixed in 0.9.1.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-47274 · Other software · mcdope · reported by GitHubMedium 6.3
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-47273 · Other software · mcdope · reported by GitHubMedium 6.5
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb builds XPath expressions from user-supplied identifiers (PAM username, service name) and device-supplied identifiers (USB device serial, model, vendor) to query /etc/pamusb.conf. These identifiers were not validated for XPath metacharacters, allowing injection of arbitrary XPath predicates. This vulnerability is fixed in 0.9.0.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-47272 · Other software · mcdope · reported by GitHubHigh 7.1
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, the pusb_pad_compare() function in src/pad.c only verified that the user-side pad (~/.pamusb/device.pad) could be read, but did not enforce that the system-side pad (the pad file on the USB device) was also present and readable. If the user-side pad was deleted or unreadable, the function returned a failure that was treated as non-fatal in certain code paths, allowing authentication to succeed without the USB device being verified. A local user can delete their own ~/.pamusb/device.pad to remove the USB device requirement and authenticate without the physical device. This vulnerability is fixed in 0.9.0.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026pam_usb provides hardware authentication for Linux using ordinary removable media.CVE-2026-47271 · Other software · mcdope · reported by GitHubMedium 5.1
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, src/mem.c implemented out-of-memory guards for xmalloc(), xrealloc(), and xstrdup() using assert(data != NULL). The C standard specifies that all assert() expressions are compiled out when NDEBUG is defined at build time. NDEBUG is commonly defined in release and packaging builds (Debian, Fedora, Arch package flags all define it via -DNDEBUG in CFLAGS). With the guard removed, xmalloc/xrealloc/xstrdup silently return NULL on allocation failure. Every caller in the codebase dereferences the return value without a NULL check -- this is the intended design, as the guard was supposed to abort before the dereference. With the guard gone, any allocation failure causes a NULL pointer dereference, crashing the PAM module. A crash in a PAM module loaded by sudo or login causes authentication to fail for the duration of the crash, creating a local denial-of-service condition. An attacker who can induce memory pressure at authentication time can lock all users out of sudo and login. This vulnerability is fixed in 0.9.0.
- Product
- pam_usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2026A security flaw has been discovered in Oinone Pamirs up to 7.2.0.CVE-2026-8736 · Other software · Oinone · reported by VulDBLow 0.9
A security flaw has been discovered in Oinone Pamirs up to 7.2.0. This vulnerability affects the function request.getParameter of the file LocalFileClient.java of the component RestController. Performing a manipulation of the argument uniqueFileName results in path traversal. The attack may be carried out on the physical device. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Pamirs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2026A vulnerability was identified in Oinone Pamirs up to 7.2.0.CVE-2026-8735 · Other software · Oinone · reported by VulDBLow 2.1
A vulnerability was identified in Oinone Pamirs up to 7.2.0. This affects the function JsonUtils.parseMap of the file PamirsParserConfig.java of the component appConfigQuery Interface. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Pamirs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2026A vulnerability was determined in Oinone Pamirs up to 7.2.0.CVE-2026-8734 · Other software · Oinone · reported by VulDBMedium 5.5
A vulnerability was determined in Oinone Pamirs up to 7.2.0. Affected by this issue is the function RSQLToSQLNodeConnector.makeVariable of the component queryListByWrapper Interface. This manipulation causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Pamirs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2026Oinone Pamirs 7.0.0 contains a command injection vulnerability in CommandHelper.executeCommands.CVE-2026-39054 · Other software · reported by MITREHigh 7.3
Oinone Pamirs 7.0.0 contains a command injection vulnerability in CommandHelper.executeCommands. The method starts a shell process and writes attacker-controlled command strings directly to the process standard input without sanitization. In affected deployments, this can result in arbitrary operating system command execution.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 15, 2026Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic.CVE-2026-39053 · Other software · reported by MITREMedium 6.5
Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic. When attacker-controlled XML is passed to framework parsing entry points such as PamirsXmlUtils.fromXML(...) or ViewXmlUtils.fromXML(...), unsafe XML processing can lead to file disclosure or SSRF.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 15, 2026Oinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner.CVE-2026-39052 · Other software · reported by MITREMedium 6.5
Oinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner. The method ScriptRunner.run(String expression, String type, Map<String, Object> context) evaluates attacker-controlled script expressions through the underlying script engine without sandboxing or allowlist restrictions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 12, 2026mosparo is the modern solution to protect your online forms from spam.CVE-2026-41195 · Other software · mosparo · reported by GitHubMedium 5
mosparo is the modern solution to protect your online forms from spam. Prior to 1.4.13, the automatic rule package source URL feature allows a project member with the editor role to store an attacker-controlled URL that the server later fetches. Because the server follows http/https redirects and does not restrict private or loopback destinations, this becomes a stored SSRF primitive that can be turned into an internal HTTP probing oracle. This vulnerability is fixed in 1.4.13.
- Product
- mosparo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET.CVE-2026-42348 · Other software · open-telemetry · reported by GitHubMedium 5.9
OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.
- Product
- opentelemetry-dotnet-contrib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secretCVE-2026-8407 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.11.0 * Devolutions Server 2025.3.16.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes.CVE-2026-43916 · Other software · identd-ng · reported by GitHubHigh 8.7
pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes. Prior to 0.2.0-alpha, a heap buffer over-read in peer_lookup_tcp (src/peer_lookup.c:134, prior to the fix) allowed a crafted NETLINK_SOCK_DIAG reply to slip past the message-size check, then dereference past the end of the allocation. This vulnerability is fixed in 0.2.0-alpha.
- Product
- pam_authnft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.