Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,381 results · page 2 of 68
Oct 14, 2026Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.CVE-2026-54703 · Other software · shd101wyy · reported by GitHubMedium 5.8
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that the target is the Markdown file represented by the current preview. JavaScript already executing in the preview webview can invoke this command through the extension message bridge and write any file permitted by the VS Code user's operating-system privileges, including user configuration, startup, source, and build files. This file-write vulnerability requires a separate webview JavaScript execution path, such as the independently tracked head.html injection and blind command-dispatch weaknesses. This issue is fixed in version 0.8.30.
- Product
- vscode-markdown-preview-enhanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.CVE-2026-54702 · Other software · shd101wyy · reported by GitHubHigh 7.3
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk execution, export-tool execution, and arbitrary URL opening, with attacker-selected arguments. Exploitation requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection, but no further authorization check protects the extension-host command boundary. This issue is fixed in version 0.8.30.
- Product
- vscode-markdown-preview-enhanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.CVE-2026-54701 · Other software · shd101wyy · reported by GitHubMedium 6.9
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extension host. Opening a Markdown preview in a malicious repository is sufficient to trigger the injected content, and no additional click within the notification or preview is required. This issue is fixed in version 0.8.30.
- Product
- vscode-markdown-preview-enhanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.CVE-2026-54566 · Other software · shd101wyy · reported by GitHubHigh 8.5
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.
- Product
- vscode-markdown-preview-enhanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.CVE-2026-54525 · Other software · shd101wyy · reported by GitHubHigh 8.8
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user. The attack requires one normal preview-link click but does not require malicious workspace configuration, script execution to be enabled, or additional files. This issue is fixed in version 0.8.28.
- Product
- vscode-markdown-preview-enhanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates it in verifyCVE-2026-75084 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgMedium 6.8
The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates it in verify_rxfifo_validity() (drivers/ieee802154/ieee802154_cc1200.c). That validation only enforced a lower bound (pkt_len < 3); its second clause rejects a FIFO that holds more bytes than declared and therefore never bounds large values. Because the driver configures the radio for variable packet length with PKT_LEN = 0xFF, the length byte is an over-the-air value of 0-255 that reached net_pkt_rx_alloc_with_buffer() and the subsequent SPI burst read unclamped. An unauthenticated attacker within radio range can transmit a frame that presents a length byte above the IEEE 802.15.4 maximum of 127 while the chip's 128-byte RX FIFO has not overflowed, so the driver's RX_FIFO_ERROR pre-check does not fire. Reaching this state depends on RF framing and timing, since the RX thread is driven off the PKT_SYNC_RXTX signal and may sample the FIFO before a packet is complete; no pairing, authentication, or user interaction is required. With the default CONFIG_NET_BUF_FIXED_DATA_SIZE and CONFIG_NET_BUF_DATA_SIZE=128, an allocation larger than on
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values toCVE-2026-110643 · Other software · kky-ykk · reported by VulnCheckCritical 9.3
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.
- Product
- transcribe2texts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2026-70098 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a netwCVE-2026-102238 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2026-102235 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-102234 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.4
Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.CVE-2026-97799 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Out-of-bounds read in Windows Audio Service allows an authorized attacker to disclose information locally.CVE-2026-96314 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Out-of-bounds read in Windows Audio Service allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a netwCVE-2026-96230 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Visual Studio 2022 version 17.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.CVE-2026-85790 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft Visual Studio 2022 version 17.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.CVE-2026-83644 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Null pointer dereference in Windows Audio Service allows an authorized attacker to disclose information locally.CVE-2026-83571 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Null pointer dereference in Windows Audio Service allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.CVE-2026-70230 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.CVE-2026-70179 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Visual Studio 2022 version 17.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests.CVE-2026-70162 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.
- Product
- Microsoft Visual Studio 2022 version 17.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-70159 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft Visual Studio 2022 version 17.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.CVE-2026-70140 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.CVE-2026-70118 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.CVE-2026-69977 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over aCVE-2026-69370 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attackCVE-2026-103572 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Visual Studio 2022 version 17.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.CVE-2026-102869 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.CVE-2026-102851 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-102233 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-102232 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-102231 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.7
Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over CVE-2026-102229 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static pCVE-2026-19940 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgMedium 6.5
The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static pool indexed by ACL connection index. On link teardown, hfp_ag_disconnected() cancels ag->tx_work and the per-call work items and then clears ag->acl_conn, which marks the pool slot as free — but it leaves ag->ongoing_call_work (and ag->slc_work) untouched. The next connection that lands on the same slot enters hfp_ag_create(), whose only occupancy test is ag->acl_conn, and immediately executes memset(ag, 0, sizeof(struct bt_hfp_ag)) followed by k_work_init_delayable(). Zeroing and re-initialising a k_work_delayable whose struct _timeout node is still linked into the kernel timeout list leaves the kernel holding a reference to a node with NULL prev/next links. ag->ongoing_call_work is armed by the remote peer: when a Hands-Free unit sends AT+CIND? during Service Level Connection establishment and the application provides the asynchronous get_ongoing_call callback, the AG schedules the work for CONFIG_BT_HFP_AG_GET_ONGOING_CALL_TIMEOUT milliseconds (default 10000). The timer is cancelled only if the application answers in tim
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Dio is a powerful HTTP client for Dart and Flutter.CVE-2026-103030 · Other software · cfug · reported by GitHubHigh 7.5
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.
- Product
- dio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use-after-free in the Audio/Video: Playback component.CVE-2026-109738 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 13, 2026Use-after-free in the Audio/Video component.CVE-2026-109727 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 12, 2026Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform.CVE-2026-49484 · Other software · codefori · reported by GitHubMedium 5.1
Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where /tmp is accessible to other local accounts, file contents remain readable after download or editing operations. This issue is fixed in version 3.0.1.
- Product
- vscode-ibmi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform.CVE-2026-49483 · Other software · codefori · reported by GitHubHigh 8.9
Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.
- Product
- vscode-ibmi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in CVE-2026-109329 · Other software · Admidio · reported by VulnCheckHigh 8.5
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a foreign role UUID to gain privileged membership, log into that organization, and edit its user profiles.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRST_NAMECVE-2026-109328 · Other software · Admidio · reported by VulnCheckMedium 5.3
Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRST_NAME registration value into an unencoded data-message attribute. Attackers can register with a double-quoted event handler that executes JavaScript in an administrator's session when they hover the entry on the Manage registrations page.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticatedCVE-2026-109327 · Other software · Admidio · reported by VulnCheckMedium 5.1
Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript: URL containing a decoy http:// segment that passes validation and executes script in the Admidio origin when victims click the redirect link.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow.CVE-2026-109311 · Other software · vllm-project · reported by VulnCheckHigh 7.1
vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without jCVE-2026-109254 · Other software · FreeRDP · reported by VulnCheckMedium 6
FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining play_thread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to read freed heap memory and crash.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently valiCVE-2026-85953 · Other software · Progress Software Corporation · reported by security@progress.comHigh 8.5
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution under an unintended identity.
- Product
- MarkLogic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 12, 2026SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly comCVE-2026-109226 · Other software · sgl-project · reported by VulnCheckHigh 8.7
SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.
- Product
- sglang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1.CVE-2026-108523 · Other software · Studio-Saelix · reported by VulDBLow 2.1
A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repo_url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The presence of this vulnerability remains uncertain at this time. This patch is called 79b86ddcd4aefdd6941f098e35990ab397b13c72. It is advisable to implement a patch to correct this issue. The vendor explains: "Git repository access is an intentional, privileged administrative function. Sencho explicitly supports repositories hosted on private LAN, VPC, VPN, CGNAT, and IPv6 ULA networks. The report does not demonstrate a privilege-boundary bypass or access by an unprivileged user. We therefore dispute the CVE characterization of this behavior. As defense in depth, we have nevertheless hardened repository access. Git HTTPS and SSH connections now validate and pin DNS resolution, reject loopback, link-local, multicast, selected special-use and metadata targets, disable redirects and inherited proxy routing,
- Product
- Sencho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 11, 2026A vulnerability was found in Studio-Saelix Sencho up to 0.94.1.CVE-2026-108522 · Other software · Studio-Saelix · reported by VulDBMedium 5.5
A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72. To fix this issue, it is recommended to deploy a patch. The vendor confirms: "The login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing an attacker to rotate the apparent client address. The remediation now ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity."
- Product
- Sencho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 10, 2026A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1.CVE-2026-108521 · Other software · Studio-Saelix · reported by VulDBLow 2
A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration."
- Product
- Sencho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Oct 10, 2026Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.CVE-2026-62087 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar: Stored Cross-Site ScriptingCVE-2026-16776 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.14.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress's save-time wp_kses_post does not neutralize the payload because the attack is delivered via shortcode attributes rather than raw HTML in post content, allowing the unescaped values to survive to render time.
- Product
- MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
- Affected
- up to 5.14.2
- What to do
- Affects up to 5.14.2. Update MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.