Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
32,248 results · page 2 of 645
Oct 27, 2026App passwords were allowed to bypass password confirmation on sensitive endpoints.CVE-2026-77172 · Other software · Nextcloud · reported by support@hackerone.comMedium 5.3
App passwords were allowed to bypass password confirmation on sensitive endpoints.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table.CVE-2026-77167 · Other software · Nextcloud · reported by support@hackerone.comHigh 7.5
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.
- Product
- server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Authlib is a Python library which builds OAuth and OpenID Connect servers.CVE-2026-116672 · Other software · authlib · reported by GitHubHigh 8.8
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.
- Product
- authlib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.CVE-2026-109090 · Other software · x.org · reported by meissner@suse.deHigh 7.5
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
- Product
- libXi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.freedesktop.org
Oct 27, 2026A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.CVE-2026-109089 · Other software · X.Org · reported by meissner@suse.deHigh 7.5
A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.
- Product
- libXi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.freedesktop.org
Oct 27, 2026A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst beforeCVE-2026-109088 · Other software · X.org · reported by meissner@suse.deMedium 6.5
A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.
- Product
- libXtst
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.freedesktop.org
Oct 27, 2026Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for CVE-2026-108014 · Other software · HCLSoftware · reported by psirt@hcl.comCritical 9.1
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Domino Server. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.
- Product
- Domino Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 27, 2026A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileCVE-2026-106077 · Other software · Veeam · reported by support@hackerone.comHigh 8.3
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
- Product
- Backup for Microsoft 365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outsidCVE-2026-12887 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.1
In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.com
Oct 27, 2026Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcCVE-2026-117601 · Other software · spesmilo · reported by VulnCheckCritical 9.3
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.
- Product
- electrum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run CVE-2026-117569 · Other software · alishahid74 · reported by VulnCheckHigh 8.5
Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP server user.
- Product
- kali-gpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs CVE-2026-117565 · Other software · ArtalkJS · reported by VulnCheckMedium 6.9
Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a page_key to an internal URL, which GetTitleByURL fetches after only scheme validation, then read the page title through the public comment list.
- Product
- Artalk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metachaCVE-2026-117558 · Other software · ai-sdlc-framework · reported by VulnCheckHigh 8.5
The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync(), letting prompt-injected agents execute commands as the MCP server user.
- Product
- ai-sdlc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain sCVE-2026-10537 · Other software · BMC · reported by cert@airbus.comMedium 6.9
A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability. This vulnerability affects : * Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions. * Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions
- Product
- Control-M/Enterprise Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery.CVE-2026-65120 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.1
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.
- Product
- TensorRT-LLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Oct 27, 2026NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery.CVE-2026-24269 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.1
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure and data tampering.
- Product
- TensorRT-LLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Oct 27, 2026Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server,CVE-2026-4337 · Other software · PuMuKIT · reported by cve-coordination@incibe.esHigh 8.8
Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server, and to any path where the web server user has write permissions. This could also allow them to delete files.
- Product
- PuMuKIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.CVE-2026-117466 · Other software · Octopus Deploy · reported by security@octopus.comHigh 8.6
In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.com
Oct 27, 2026In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log.CVE-2026-117341 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.7
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.com
Oct 27, 2026In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently.CVE-2026-116870 · Other software · Octopus Deploy · reported by security@octopus.comHigh 8.7
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured. An attacker would also need to know or guess some details of that identity in order to be in a position to attempt exploitation.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.com
Oct 27, 2026A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers.CVE-2026-111548 · Other software · Moxa · reported by psirt@moxa.comMedium 5.3
A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers. An authenticated remote attacker with low privileges could exploit insufficient bounds checking of user-supplied input, causing the web management service to become unresponsive. Restoring the service requires power cycling the affected device, while other device functions remain operational.
- Product
- NPort W2150A-W4/W2250A-W4 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credCVE-2026-110737 · Other software · vaadin · reported by security@vaadin.comLow 2.3
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor then echoes whatever Origin the request carries. A page on any origin can therefore make a cross origin request to that endpoint with the user's cookies and read the response, although reading anything useful also requires the push identifier of that session. Applications that do not use @Push are not affected, and neither is the WebSocket transport. The behaviour was introduced in January 2015 and is present in every Flow release and in Vaadin Framework from 7.1.0, which is when push was added. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 14.14.0 - 14.14.7 Vaadin 23.6.0 - 23.6.16 Vaadin 24.4.0 - 24.4.25 Vaadin 24.5.0 - 24.5.15 Vaadin 24.6.0 - 24.6.13 Vaadin 24.7.0 - 24.7.16 Vaadin 24.8.0 - 24.8.17 Vaadin 24.9.0 - 24.9.23 Vaadin 24.10.0 - 24.10.11 Vaadin 25.0.0 - 25.0.13 Vaadin 25.1.0 - 25.1.13 Vaadi
- Product
- vaadin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Stack-based Buffer Overflow Vulnerability in HiRDB.CVE-2026-82122 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.4
Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.
- Product
- HiRDB Server Version 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Origin Validation Error Vulnerability in HiRDB.CVE-2026-82121 · Other software · Hitachi · reported by hirt@hitachi.co.jpHigh 7.5
Origin Validation Error Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.
- Product
- HiRDB Server Version 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Heap-based Buffer Overflow Vulnerability in HiRDB.CVE-2026-82120 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.8
Heap-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.
- Product
- HiRDB Server Version 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026OS Command Injection Vulnerability in HiRDB.CVE-2026-82119 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.8
OS Command Injection Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.
- Product
- HiRDB Server Version 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Stack-based Buffer Overflow Vulnerability in HiRDB.CVE-2026-82118 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.8
Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.
- Product
- HiRDB Server Version 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Authentication Bypass by Spoofing Vulnerability in HiRDB.CVE-2026-82117 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.8
Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.
- Product
- HiRDB Server Version 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Missing Authentication for Critical Function Vulnerability in HiRDB.CVE-2026-82116 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.8
Missing Authentication for Critical Function Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.
- Product
- HiRDB Server Version 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path.CVE-2026-117472 · Other software · esaqa GmbH · reported by fdf66990-8419-4c8c-8848-ec15d75773b4Medium 4.3
Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected.
- Product
- Psono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client withouCVE-2026-117471 · Other software · esaqa GmbH · reported by fdf66990-8419-4c8c-8848-ec15d75773b4Medium 5.4
Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.
- Product
- Psono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification.CVE-2026-117470 · Other software · esaqa GmbH · reported by fdf66990-8419-4c8c-8848-ec15d75773b4Medium 6.5
Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets.
- Product
- Psono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations.CVE-2026-117469 · Other software · esaqa GmbH · reported by fdf66990-8419-4c8c-8848-ec15d75773b4Medium 5.4
Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner's file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits.
- Product
- Psono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code.CVE-2026-117468 · Other software · esaqa GmbH · reported by fdf66990-8419-4c8c-8848-ec15d75773b4Medium 6.5
Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.
- Product
- Psono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not wheCVE-2026-116844 · Other software · fclairamb · reported by VulnCheckMedium 6.3
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.
- Product
- ftpserverlib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated adminiCVE-2026-116827 · Other software · YesWiki · reported by VulnCheckHigh 8.2
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension check with a query-string suffix or redirects to fetch cloud metadata credentials, internal services, or local files via file://, with responses stored in the web-accessible files/ directory.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 26, 2026YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to makeCVE-2026-116826 · Other software · YesWiki · reported by VulnCheckHigh 8.2
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 26, 2026Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query oCVE-2026-116801 · Other software · parse-community · reported by VulnCheckMedium 5.3
Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead of an object ID bypasses the owning-object ACL check. A client with read access to at least one object of the owning class can disclose which readable objects are linked to owning objects it cannot read.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 26, 2026Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSCVE-2026-116748 · Other software · transmission · reported by VulnCheckHigh 8.7
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.
- Product
- transmission
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026An access-control vulnerability has been identified in the web server configuration.CVE-2026-70381 · Other software · WolfVision · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 6.9
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.
- Product
- Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable.CVE-2026-72757 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlMedium 5.3
Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. This only affects users that make their HTTP or RTR server available to untrusted networks.
- Product
- Routinator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to CVE-2026-50096 · Other software · Esri · reported by psirt@esri.comMedium 6.1
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and Linux that in some configurations allows a remote unauthenticCVE-2026-50095 · Other software · Esri · reported by psirt@esri.comMedium 6.1
There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata.CVE-2026-33522 · Other software · Esri · reported by psirt@esri.comMedium 5.3
Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, and 11.3. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted reqCVE-2026-33521 · Other software · Esri · reported by psirt@esri.comHigh 7.5
There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to CVE-2026-33520 · Other software · Esri · reported by psirt@esri.comMedium 6.1
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for impacted ArcGIS Server software in General Availability and Extended support status, which includes versions 11.5. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to CVE-2026-10757 · Other software · Esri · reported by psirt@esri.comCritical 9.8
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.CVE-2026-81038 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgHigh 7.1
The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c). Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BT_GATT_OTS_OACP_PROC_CHECKSUM_CALC, regardless of the result code. The response payload is a bare, uninitialized four-byte stack buffer declared with NET_BUF_SIMPLE_DEFINE(resp_param, sizeof(uint32_t)) in bt_gatt_ots_oacp_write(), and it is filled only on the success path of oacp_checksum_proc_validate(). On every failure path the buffer is still empty, so net_buf_simple_pull_le32() was invoked on a zero-length buffer. The OACP characteristic and its client characteristic configuration descriptor are declared with BT_GATT_PERM_WRITE and BT_GATT_PERM_READ | BT_GATT_PERM_WRITE, so no pairing, encryption, or authentication is required. Any peer within radio range that can connect to a device running the OTS server can enable OACP indications and write a nine-byte Calculate Checksum command that fails validation — for example by issuing it with no object selected, which returns BT_GATT_OTS_OACP_RES_INV_OBJ. Because oacp_comma
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value.CVE-2026-106676 · Other software · reported by MITRE
qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and creating negative-value orders.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0.CVE-2026-116369 · Other software · Sunwood-ai-labs · reported by VulDBMedium 5.3
A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading to version 0.4.1 is recommended to address this issue. The name of the patch is 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae. It is suggested to upgrade the affected component.
- Product
- github-kanban-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.