Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,120 results · page 2 of 483
Oct 27, 2026An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3.CVE-2026-102815 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 6.9
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the TDDPv1 service and execute operating-system commands with root privileges. Successful exploitation may allow a local attacker with low privileges to obtain root privileges and execute arbitrary operating-system commands on the affected device.
- Product
- RE305 v3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Oct 27, 2026An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3.CVE-2026-102814 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 8.7
An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionality that can lead to operating-system command execution when the TDDP service is running and accessible. Successful exploitation may allow an unauthenticated attacker on the same local area network to execute arbitrary system commands with root privileges.
- Product
- RE305 v3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Oct 27, 2026An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3.CVE-2026-102813 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 6.1
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effective attempt counter or lockout mechanism and uses a predictable verification-code generation process, an attacker may obtain or brute-force the code and reset the administrator password. Successful exploitation may allow an unauthenticated attacker on the local network to reset the administrator password and subsequently access privileged device-management functions.
- Product
- RE305 v3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Oct 27, 2026A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5.CVE-2026-102812 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 6.9
A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component. An attacker who obtains an affected configuration backup file may extract the cryptographic material from the firmware and use it to decrypt the backup. Successful exploitation may disclose sensitive configuration information contained in a backup file, including administrator passwords and Wi-Fi credentials.
- Product
- RE305 v3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Oct 27, 2026A vulnerability was identified in oretnom23 php-travel-agency-system.CVE-2026-117514 · Other software · oretnom23 · reported by VulDBMedium 5.5
A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer_detail.php of the component Admin Record Pages. The manipulation of the argument costomer_id/ticket_id/emp_id/salary_id/page_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- php-travel-agency-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A vulnerability was determined in oretnom23 php-travel-agency-system.CVE-2026-117513 · Other software · oretnom23 · reported by VulDBMedium 5.5
A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer_search.php of the component Admin Search Pages. Executing a manipulation of the argument customer_name/voucher_no/emp_name can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- php-travel-agency-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A vulnerability was found in oretnom23 php-travel-agency-system.CVE-2026-117512 · Other software · oretnom23 · reported by VulDBMedium 5.5
A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- php-travel-agency-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026systeminformation is a System and OS information library for node.js.CVE-2026-116674 · Other software · sebhildebrandt · reported by GitHubMedium 6.5
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object _network cache and indexes it with the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own cache entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and their values come from interface statistics, but inherited-name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior. This issue is fixed in version 5.33.13.
- Product
- systeminformation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026systeminformation is a System and OS information library for node.js.CVE-2026-116673 · Other software · sebhildebrandt · reported by GitHubLow 3.3
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.
- Product
- systeminformation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileCVE-2026-106077 · Other software · Veeam · reported by support@hackerone.comHigh 8.3
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
- Product
- Backup for Microsoft 365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, CVE-2025-64394 · Other software · Veeam · reported by support@hackerone.comMedium 4.3
A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.
- Product
- Backup for Microsoft 365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged systCVE-2026-93865 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Critical 9.2
A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to oveCVE-2026-93864 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3High 7.1
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and triggering a list update. Written content is partially constrained.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar.CVE-2026-109823 · Other software · tidewave-ai · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbLow 2.3
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout. This issue affects tidewave: from 0.8.0 before 0.9.2.
- Product
- tidewave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 27, 2026Eaton easySoft improperly validates TLS certificates presented by easyE4 devices.CVE-2026-41022 · Other software · Eaton · reported by CybersecurityCOE@eaton.comMedium 5.9
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4.
- Product
- easySoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control CVE-2026-13162 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 7.7
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting the system time-zone. When processing time-zone configuration updates, the daemon constructs a shell command by concatenating user-supplied input without any sanitization or validation.
- Product
- CoreTec 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Oct 27, 2026In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.CVE-2026-117466 · Other software · Octopus Deploy · reported by security@octopus.comHigh 8.6
In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.com
Oct 27, 2026Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.CVE-2026-76939 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.8
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
- Product
- JP1/Automatic Job Management System 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3.CVE-2026-76938 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.8
Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
- Product
- JP1/Automatic Job Management System 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.CVE-2026-76937 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.4
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
- Product
- JP1/Automatic Job Management System 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.CVE-2026-76936 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.4
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
- Product
- JP1/Automatic Job Management System 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.CVE-2026-76935 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.4
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
- Product
- JP1/Automatic Job Management System 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.CVE-2026-76934 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.8
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
- Product
- JP1/Automatic Job Management System 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.CVE-2026-76933 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.4
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
- Product
- JP1/Automatic Job Management System 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.CVE-2026-76932 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.4
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
- Product
- JP1/Automatic Job Management System 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMCCVE-2026-65213 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411Medium 6.6
This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC
- Product
- MBD-X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.CVE-2026-65211 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411High 7.2
This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.
- Product
- MBD-X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI manaCVE-2026-65210 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411Medium 4.9
This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.
- Product
- MBD-X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmittCVE-2026-101034 · Other software · Broadcom · reported by secure@symantec.comMedium 6.8
An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmitted by GSS Deployment Server installation.
- Product
- Symantec Ghost Solution Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8197510c0910f759e06ee67251e5.CVE-2026-116640 · Other software · Saruf-Ratul · reported by VulDBLow 2
A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8197510c0910f759e06ee67251e5. Affected by this vulnerability is an unknown functionality of the file chat.php. Executing a manipulation of the argument ID can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- HR-Payroll-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd.CVE-2026-116639 · Other software · MD-MAFUJUL-HASAN · reported by VulDBLow 2
A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Payroll-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026systeminformation is a System and OS information library for node.js.CVE-2026-116576 · Other software · sebhildebrandt · reported by GitHubHigh 7.8
systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16.
- Product
- systeminformation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578.CVE-2026-116482 · Other software · subhajitkhan · reported by VulDBLow 2
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected is an unknown function of the file patientregistration.php. Such manipulation of the argument pat_name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- online-clinic-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system CVE-2026-116632 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 26, 2026In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/host/classic/hfp_ag.c starts an SDP discovery toward the peeCVE-2026-82389 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgMedium 6.5
In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/host/classic/hfp_ag.c starts an SDP discovery toward the peer, which links the embedded ag->sdp_param._node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the subsequent bt_rfcomm_dlc_connect() call fails, bt_hfp_ag_connect() cleaned up by memset()-ing the entire AG object while that node was still linked, and while ag->slc_work could still be queued on the system work queue. An in-flight SDP discovery cannot be cancelled — bt_sdp_discover_cancel() is declared in the public header but has no implementation — so the request stays in the list with its func, pool and uuid pointers zeroed. The RFCOMM channel passed to bt_hfp_ag_connect() is taken from the peer's own SDP Hands-Free service record in the normal AG flow (bt_sdp_get_proto_param() performs no range validation, and samples/bluetooth/classic/handsfree_ag feeds the value straight through), so a remote BR/EDR device in radio range that advertises an RFCOMM channel outside the valid range 0x01..0x1e deterministically forces bt_rfcomm_dlc_connect() to fail and reach the wipe. Reading the peer
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP discoCVE-2026-82388 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgMedium 5.3
bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP discovery by passing the object's embedded hf->sdp_param to bt_sdp_discover(). That call links the caller-owned parameter block into the SDP client's request list (session->reqs in subsys/bluetooth/host/classic/sdp.c). If the subsequent bt_rfcomm_dlc_connect() then failed, the affected code wiped the entire object with (void)memset(new_hf, 0, sizeof(*new_hf)) while that discovery was still outstanding, zeroing the sys_snode_t _node that is still linked in the SDP client's list along with the request's func, uuid and pool pointers, and zeroing the hf->slc_work work item that may already be queued on the system workqueue. The discovery could not be retracted instead: bt_sdp_discover_cancel() is declared in include/zephyr/bluetooth/classic/sdp.h but has no implementation. The failing branch is reachable with peer-supplied input. The documented use of bt_hfp_hf_connect() is to pass the RFCOMM channel read out of the remote Audio Gateway's SDP record; neither bt_sdp_get_proto_param() nor bt_hfp_hf_connect() range-checks that value, s
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.CVE-2026-81038 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgHigh 7.1
The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c). Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BT_GATT_OTS_OACP_PROC_CHECKSUM_CALC, regardless of the result code. The response payload is a bare, uninitialized four-byte stack buffer declared with NET_BUF_SIMPLE_DEFINE(resp_param, sizeof(uint32_t)) in bt_gatt_ots_oacp_write(), and it is filled only on the success path of oacp_checksum_proc_validate(). On every failure path the buffer is still empty, so net_buf_simple_pull_le32() was invoked on a zero-length buffer. The OACP characteristic and its client characteristic configuration descriptor are declared with BT_GATT_PERM_WRITE and BT_GATT_PERM_READ | BT_GATT_PERM_WRITE, so no pairing, encryption, or authentication is required. Any peer within radio range that can connect to a device running the OTS server can enable OACP indications and write a nine-byte Calculate Checksum command that fails validation — for example by issuing it with no object selected, which returns BT_GATT_OTS_OACP_RES_INV_OBJ. Because oacp_comma
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers (gen_stable_iid() in subsys/net/ip/ipv6.c) and RFC 8981 tCVE-2026-19742 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgLow 3.7
The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers (gen_stable_iid() in subsys/net/ip/ipv6.c) and RFC 8981 temporary interface identifiers (gen_temporary_iid() in subsys/net/ip/ipv6_pe.c) with sys_rand_get(). That API is documented as not cryptographically secure, while both RFCs require this key to be an unpredictable random value of at least 128 bits — the unpredictability of every generated IID rests entirely on it. Depending on the platform, sys_rand_get() resolves either to a hardware entropy device or, on boards whose entropy driver sets CONFIG_ENTROPY_NEEDS_PRNG, to the non-cryptographic xoshiro128++ generator in subsys/random/random_xoshiro128.c, which keeps a single global 128-bit state shared with every other sys_rand_get() consumer. Many of those consumers put their output directly on the wire (ephemeral source ports, DNS query IDs, CoAP message IDs and tokens, DHCPv6 transaction IDs, WebSocket masking keys), and the xoshiro state transition is invertible, so an observer of a device's traffic can recover the generator state and reconstruct the IID secret key. Additionally, with the entropy-device backend sys_rand_get()
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpoint request which allows a System AdminiCVE-2026-93848 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.7
Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpoint request which allows a System Administrator to determine whether internal addresses and ports are reachable from the server via an unauthenticated login request that triggers the discovery fetch.. Mattermost Advisory ID: MMSA-2026-00774
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticCVE-2026-93847 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.5
Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.. Mattermost Advisory ID: MMSA-2026-00732
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` witCVE-2026-65184 · Other software · Vertiv · reported by 44488dab-36db-4358-99f9-bc116477f914Critical 9.8
The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.
- Product
- Avocent ACS8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrunzero.comrunzero.com
Oct 26, 2026Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without vaCVE-2026-116213 · Other software · Webasyst · reported by VulnCheckMedium 6.9
Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or /etc/passwd and read them through the public theme path.
- Product
- Webasyst Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScCVE-2026-116212 · Other software · Webasyst · reported by VulnCheckMedium 5.1
Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions.
- Product
- Webasyst Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions bCVE-2026-116210 · Other software · Webasyst · reported by VulnCheckHigh 7.1
Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.
- Product
- Webasyst Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Contact Form by Supsystic: Missing AuthorizationCVE-2026-115595 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7.
- Product
- Contact Form by Supsystic
- Affected
- up to 1.10.7
- What to do
- Affects up to 1.10.7. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2026SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system.CVE-2026-82946 · Other software · RT-Labs AB · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 6.5
SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.
- Product
- SOEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access CVE-2026-113345 · Other software · Ministry of Land, Infrastructure, Transport and Tourism, Japan · reported by vultures@jpcert.or.jpHigh 8.5
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.
- Product
- Electronic delivery item Inspection Support System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d.CVE-2026-116112 · Other software · HashenUdara · reported by VulDBMedium 5.5
A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the file admin/add-new.php. The manipulation of the argument spec leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- edoc-doctor-appointment-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Oct 25, 2026Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration eCVE-2026-116197 · Other software · edgelesssys · reported by VulnCheckLow 2.1
Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.
- Product
- contrast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull infoCVE-2026-116153 · Other software · ImageMagick · reported by VulnCheckLow 2
ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes or potential code execution.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.