Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,659 results · page 20 of 114
Jul 23, 2026Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.CVE-2026-59545 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.CVE-2026-59524 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.
- Affected
- up to 3.6.7
- What to do
- Affects up to 3.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.CVE-2026-59522 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.
- Affected
- up to 1.17.5
- What to do
- Affects up to 1.17.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.CVE-2026-57717 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.
- Affected
- up to 9.6.0.0
- What to do
- Affects up to 9.6.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.CVE-2026-57716 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.
- Affected
- up to 7.2.4
- What to do
- Affects up to 7.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.CVE-2026-57703 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.
- Affected
- up to 3.6.10.1
- What to do
- Affects up to 3.6.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.CVE-2026-57425 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.
- Affected
- up to 2.2.27
- What to do
- Affects up to 2.2.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.CVE-2026-57367 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.CVE-2026-27423 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.
- Affected
- up to 2.7.8.4
- What to do
- Affects up to 2.7.8.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.CVE-2026-27418 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.
- Affected
- up to 1.81.282
- What to do
- Affects up to 1.81.282. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.CVE-2026-27399 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.
- Affected
- up to 2.1.40
- What to do
- Affects up to 2.1.40. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Contributor Broken Access Control in uListing <= 2.2.0 versions.CVE-2026-27392 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in uListing <= 2.2.0 versions.
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Subscriber Broken Access Control in uListing <= 2.2.0 versions.CVE-2026-27391 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in uListing <= 2.2.0 versions.
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.CVE-2026-27377 · WordPress plugins & themes · reported by PatchstackMedium 6.7
Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.
- Affected
- up to 1.0.16
- What to do
- Affects up to 1.0.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.CVE-2026-27355 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.
- Affected
- up to 3.1.66
- What to do
- Affects up to 3.1.66. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.CVE-2026-25466 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.
- Affected
- up to 10.1.04
- What to do
- Affects up to 10.1.04. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Subscriber Broken Access Control in eRoom <= 1.7.1 versions.CVE-2026-25427 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in eRoom <= 1.7.1 versions.
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.CVE-2026-25424 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.
- Affected
- up to 2.10.10
- What to do
- Affects up to 2.10.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading tCVE-2026-65431 · Websites & servers · reported by security@joomla.orgCritical 9.8
Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory.CVE-2026-64872 · Websites & servers · reported by security@joomla.orgMedium 6.5
Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manCVE-2026-65013 · Other software · onlook · reported by VulnCheckHigh 8.7
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users' project data, members, and conversation history.
- Product
- repo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privilCVE-2026-28321 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations.
- Product
- Serv-U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Jul 21, 2026SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts.CVE-2026-28309 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments.
- Product
- Serv-U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comhttps
Jul 21, 2026HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknessCVE-2023-37508 · Other software · HCLSoftware · reported by psirt@hcl.comLow 2.3
HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present.
- Product
- DevOps Plan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 20, 2026Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnCVE-2026-60030 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attacker to crash the NanoMQ broker by sendinCVE-2026-47276 · Other software · nanomq · reported by GitHubMedium 6.5
In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to `/api/v4/mqtt/publish` with `user_properties` as a JSON array instead of a JSON object. The crash occurs because `strlen()` is called on a NULL `item->string` pointer when iterating over array elements. An authenticated attacker can exploit this to crash the NanoMQ broker process. This is patched in version 0.24.14.
- Product
- nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `nni_mqttv5_msg_decode_connect()` allows a malicious MQTT broker to crash any connecting NCVE-2026-47275 · Other software · nanomq · reported by GitHubLow 2.6
In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `nni_mqttv5_msg_decode_connect()` allows a malicious MQTT broker to crash any connecting NanoMQ MQTTv5 client (including bridge mode) with a single packet, causing remote denial of service via SIGSEGV. In `nni_mqttv5_msg_decode_connect()` (`mqtt_codec.c:1863`), the code iterates over CONNECT properties using variable `prop` when it should use `will_prop`. When a CONNECT packet has no connect-level properties (`prop == NULL`) but has will properties (`will_prop != NULL`), dereferencing `prop->next` causes SIGSEGV at address `0x38` (NULL + `offsetof(property, next)`). This affects both `nanomq_cli` and **NanoMQ bridge mode** (Core component), as both use the same `mqtt_client.c` receive path. This can lead to remote DoS if a malicious MQTT broker can crash the client process with a single 35-byte packet and persistent DoS if auto-reconnect causes infinite crash loop.
- Product
- nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026FileBrowser Quantum is a free, self-hosted, web-based file manager.CVE-2026-54910 · Other software · gtsteffaniak · reported by GitHubHigh 7.7
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the `path` parameter: it is passed directly to `idx.GetRealPath()` without calling `SanitizeUserPath()`, allowing an attacker to escape the storage root and set `parentDir` to any directory on the host. No existing anchor file is required. The secondary vector is the `name` parameter: it is joined with `parentDir` via `filepath.Join(parentDir, name)` without stripping directory components, allowing traversal relative to any resolved `parentDir`. Any authenticated user (regardless of role or permissions) can exploit either vector to read any text file readable by the server process, including `/etc/passwd`, SSH keys, database credentials, and JWT signing keys. Version 1.4.3-beta patches the issue.
- Product
- filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026FileBrowser Quantum is a free, self-hosted, web-based file manager.CVE-2026-54685 · Other software · gtsteffaniak · reported by GitHubMedium 5.3
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.
- Product
- filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026FileBrowser Quantum is a free, self-hosted, web-based file manager.CVE-2026-46410 · Other software · gtsteffaniak · reported by GitHubHigh 8.7
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. Versions 1.3.2-stable and 1.4.1-beta fix the issue. No known workarounds are available.
- Product
- filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2026In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A brokenCVE-2026-63961 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and send it off elsewhere. Fix this up by correctly verifying the count for the update object.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 19, 2026In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT A broken/malicious pCVE-2026-63959 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT A broken/malicious port can transmit a CRC-valid frame whose header advertises up to seven data objects but whose body carries fewer than that. Check for this, and rightfully reject the message, instead of reading from uninitialized stack memory.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 17, 2026IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.CVE-2026-8861 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- Product
- Verify Identity Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability.CVE-2026-21760 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 4.6
HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints.
- Product
- DevOps Loop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 17, 2026TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to accCVE-2026-63099 · Other software · TheHive-Project · reported by VulnCheckHigh 7.1
TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to access attachments belonging to other organizations by supplying a content-hash identifier. Attackers can exploit the missing organization-scoped authorization check in AttachmentSrv.visible, which is implemented as a pass-through traversal, to download arbitrary attachments.
- Product
- TheHive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 17, 2026osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-mCVE-2026-14871 · Other software · osTicket · reported by help@fluidattacks.comHigh 7.1
osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.
- Product
- osTicket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Jul 17, 2026A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption rCVE-2026-15380 · Other software · Broadcom · reported by secure@symantec.comMedium 5.1
A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required (ITMS 8.7.3)
- Product
- Symantec Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user to read the contents of any file accessible to the SYSTEM accCVE-2026-15379 · Other software · Broadcom · reported by secure@symantec.comMedium 5.1
The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user to read the contents of any file accessible to the SYSTEM account, bypassing filesystem ACLs. No admin privileges required. The provider reverts to the LocalSystem context when servicing WMI queries without re-impersonating the caller. Any local standard user can therefore read SYSTEM-readable files — including configuration files, service logs, and secrets stored with SYSTEM/Administrator-only ACLs — by querying the provider directly.
- Product
- Symantec IT Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.aCVE-2026-62235 · Other software · getgrav · reported by VulnCheckLow 2.3
Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any directory lacking an explicit permissions configuration, bypassing intended authorization controls.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 16, 2026OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinaCVE-2026-62227 · Other software · OpenClaw · reported by VulnCheckMedium 4.9
OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinations. Attackers with lower-trust access can bypass OpenClaw policy checks to reach network destinations that should have been blocked.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 16, 2026OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checkCVE-2026-62226 · Other software · OpenClaw · reported by VulnCheckMedium 5.1
OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 16, 2026OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts.CVE-2026-62220 · Other software · OpenClaw · reported by VulnCheckMedium 6.3
OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availability.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 16, 2026Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with AgentCVE-2026-63082 · Other software · Ultimate Fosters · reported by VulnCheckMedium 5.3
Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agent-level privileges to manipulate the Support Agent assignment field of tickets by bypassing intended authorization checks. Attackers can add or remove any user, including Superadmin accounts, from the Support Agent field of any ticket to which they are assigned, circumventing role-based access controls.
- Product
- Perfect Support Ticketing & Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 16, 2026HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.CVE-2026-35147 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.2
HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and perform unauthorized actions without valid credentials.
- Product
- DFXServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 15, 2026An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c componentCVE-2026-36590 · Other software · Emqx · reported by MITREHigh 7.5
An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify membeCVE-2026-59258 · Other software · immich-app · reported by VulnCheckHigh 7.2
immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities.
- Product
- immich
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Lightpanda is a headless browser designed for AI and automation.CVE-2026-52843 · Other software · lightpanda-io · reported by GitHubCritical 9.3
Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9.
- Product
- browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Lightpanda is a headless browser designed for AI and automation.CVE-2026-52842 · Other software · lightpanda-io · reported by GitHubCritical 9.3
Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as `http://attacker.com/@victim.com/` was fetched from attacker.com but treated as `http://victim.com`, allowing a complete Same-Origin Policy bypass. This issue is fixed in version 0.3.1.
- Product
- browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.CVE-2026-62843 · Other software · filebrowser · reported by GitHubMedium 6.8
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser's archive builder uses strings.ReplaceAll(nameInArchive, "\", "/"), which turns a POSIX filename such as ..\..\evil.sh into the archive entry ../../evil.sh, allowing a user with upload permission to plant a backslash-named file that escapes the extraction directory when another user downloads and extracts the generated zip or tar archive. This issue is fixed in version 2.63.17.
- Product
- filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.CVE-2026-62685 · Other software · filebrowser · reported by GitHubHigh 8.1
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername() when Signup=true and CreateUserDir=true, but the many-to-one normalization can collapse usernames such as team/one, team one, and team-one to the same home directory without checking whether the resulting scope is already taken, allowing a second registrant to gain full read and write access to another user's files. This issue is fixed in version 2.63.17.
- Product
- filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.