Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,113 results · page 2 of 43
Oct 13, 2026Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network.CVE-2026-87716 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.CVE-2026-87706 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.CVE-2026-85872 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-83911 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.CVE-2026-70238 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-69935 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privilegCVE-2026-69931 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-69856 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-69766 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-69763 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.CVE-2026-69506 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-102191 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-102189 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-102188 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-100225 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-100216 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /aCVE-2026-110108 · Other software · mateaix · reported by VulnCheckHigh 8.6
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys.
- Product
- MateCloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Information disclosure in the Storage: IndexedDB component.CVE-2026-109777 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 13, 2026Use-after-free in the Storage: Bucket File System component.CVE-2026-109741 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 13, 2026Use-after-free in the Storage: IndexedDB component.CVE-2026-109706 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 13, 2026Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instCVE-2026-109162 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aMedium 6.3
Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected. This issue affects TYPO3 CMS versions 14.0.0-14.3.8.
- Product
- TYPO3 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recoverCVE-2026-109426 · Other software · weebzone · reported by VulnCheckHigh 8.2
Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository's own decode_string function with no secret key to obtain a fully authenticated Telegram session, granting complete control of the operator's Telegram account even when two-step verification is enabled.
- Product
- Telegram-Stremio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvulncheck.com
Oct 12, 2026OpenList is a file list program that supports multiple storage backends.CVE-2026-102663 · Other software · OpenListTeam · reported by GitHubMedium 4.3
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.
- Product
- OpenList
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path wiCVE-2026-93695 · Other software · Progress · reported by security@progress.comHigh 7.4
In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.
- Product
- ShareFile Storage Zones Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavCVE-2026-93694 · Other software · Progress · reported by security@progress.comMedium 4
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.
- Product
- ShareFile Storage Zones Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response forCVE-2026-93693 · Other software · Progress · reported by security@progress.comMedium 6.5
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.
- Product
- ShareFile Storage Zones Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' filCVE-2026-109166 · Other software · dromara · reported by VulnCheckHigh 7.1
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById handler of FileAnyoneController, which never checks ownership, to retrieve access URLs and read uploaded attachments.
- Product
- lamp-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage.CVE-2026-21118 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.9
Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Oct 11, 2026Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container CVE-2026-108728 · Other software · flyteorg · reported by VulnCheckHigh 7.1
Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment variable, letting principals without Secret store access decode them from the Pod spec.
- Product
- flyte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stCVE-2026-108706 · Other software · elunez · reported by VulnCheckMedium 5.3
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/{id} to collect URLs of all uploaded objects, exposing file contents on publicly readable buckets.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated CVE-2026-108688 · Other software · elunez · reported by VulnCheckMedium 5.3
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to write files into server local storage and disclose absolute server paths.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive informationCVE-2026-87980 · Other software · IBM · reported by psirt@us.ibm.comLow 3.1
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive information in logs.
- Product
- Guardium Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql.CVE-2026-107829 · Other software · banq · reported by VulnCheckHigh 8.2
Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks.
- Product
- jivejdon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage.CVE-2026-102368 · Network & remote access · TP-Link System Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 5.4
Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware. Successful exploitation of this vulnerability may result in the disclosure of device-specific cryptographic material and could, under certain conditions, increase the risk of unauthorized access to related protected information or communications.
- Product
- Tapo S505 v1.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Oct 8, 2026An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versionsCVE-2026-94580 · Other software · Brocade · reported by sirt@brocade.comMedium 5.7
An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.
- Product
- Fabric OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability.CVE-2026-70414 · Other software · Dell · reported by security_alert@emc.comMedium 5.5
Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.
- Product
- Command | Configure (DCC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code oCVE-2026-106393 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.3
Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Oct 6, 2026Race condition in CacheStorage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outsideCVE-2026-106300 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.7
Race condition in CacheStorage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Oct 6, 2026Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability.CVE-2026-76105 · Other software · Dell · reported by security_alert@emc.comHigh 7.7
Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information tampering.
- Product
- Container Storage Modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tCVE-2026-70411 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service (TenantService). An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized creation of tenant entities, cross-tenant role injection, and modification of storage access control flags.
- Product
- Container Storage Modules (CSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability.CVE-2026-67273 · Other software · Dell · reported by security_alert@emc.comCritical 9.6
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- Container Storage Modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component.CVE-2026-67270 · Other software · Dell · reported by security_alert@emc.comHigh 8.2
Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to information exposure of storage backend administrator credentials.
- Product
- Container Storage Modules (CSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxyCVE-2026-63691 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxy . An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Unauthorized access.
- Product
- Container Storage Modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-poweCVE-2026-63690 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- Container Storage Modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability.CVE-2026-63689 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- Container Storage Modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability.CVE-2026-61411 · Other software · Dell · reported by security_alert@emc.comHigh 7.7
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- Container Storage Modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule CuCVE-2026-67269 · Other software · Dell · reported by security_alert@emc.comCritical 9.9
Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privileges and gaining root-level access on cluster nodes.
- Product
- Container Storage Modules (CSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability.CVE-2026-63692 · Other software · Dell · reported by security_alert@emc.comCritical 10
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- Container Storage Modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-CVE-2026-63688 · Other software · Dell · reported by security_alert@emc.comCritical 10
Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.
- Product
- Dell Container Storage Modules (CSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization.CVE-2026-61421 · Other software · Dell · reported by security_alert@emc.comCritical 9.8
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- Container Storage Modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.