Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
202,385 results · page 20 of 4048
Oct 27, 2026A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL.CVE-2026-118178 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local files and, on Windows, connect to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are affected by the local file read only. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointCVE-2026-118177 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths.CVE-2026-118176 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into theCVE-2026-118175 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key.CVE-2026-118174 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect.CVE-2026-118172 · Other software · Strapi · reported by cret@cert.org
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.
- Product
- Strapi Open Source and Enterprise Headless CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint.CVE-2026-118171 · Other software · Strapi · reported by cret@cert.org
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.
- Product
- Strapi Open Source and Enterprise Headless CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possCVE-2026-118170 · Other software · Strapi · reported by cret@cert.org
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
- Product
- Strapi Open Source and Enterprise Headless CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially CVE-2026-88812 · Other software · X.org · reported by meissner@suse.deHigh 7.8
A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.
- Product
- xorg-x11-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.freedesktop.org
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57202 · Other software · asterisk · reported by GitHubHigh 8.1
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57188 · Other software · asterisk · reported by GitHubHigh 7.1
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in `res_xmpp` `XMPP namespace prefix` handling using carefully crafted packets. The `res_xmpp` module must be loaded, an XMPP connection must be configured in `xmpp.conf`, and the attacker must have an XMPP account on the same or a federated server. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenCVE-2026-118132 · Other software · NextChat · reported by cret@cert.org
NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema content. When a plugin schema is loaded from a remote URL, the returned content is stored in plugin.content and later rendered using React’s dangerouslySetInnerHTML without proper sanitization. An attacker can host a malicious OpenAPI schema containing HTML or JavaScript markup and trick a user into loading it through the Plugin Editor, resulting in arbitrary JavaScript execution in the NextChat origin. Successful exploitation allows access to JavaScript‑readable cookies and other client‑side data associated with the NextChat application.
- Product
- NextChat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory aCVE-2026-118131 · Other software · GnuPG · reported by cret@cert.org
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.
- Product
- GnuPG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A vulnerability was found in reduxjs redux-devtools 5.0.0.CVE-2026-117526 · Other software · reduxjs · reported by VulDBLow 1.9
A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- redux-devtools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026HomeBox is a home inventory and organization system.CVE-2026-116680 · Other software · sysadminsmedia · reported by GitHubMedium 6.4
HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled delivery, but shoutrrr sends the request through http.DefaultClient.Do without a CheckRedirect policy that revalidates each Location target. An authenticated collection member can configure a permitted notifier host that redirects to loopback, link-local, cloud metadata, or another blocked destination, causing the follow-up request to bypass the product's SSRF policy. The flaw is reachable through POST /api/v1/notifiers/test for immediate requests and through stored notifiers during scheduled maintenance delivery. This issue is fixed in version 0.27.0.
- Product
- homebox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC.CVE-2026-116679 · Other software · m1k1o · reported by GitHubMedium 5.4
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room member who establishes a WebRTC connection can send mouse and keyboard events through the legacy control channel while controls are locked or the member is otherwise unauthorized by the modern control API. This issue is fixed in version 3.1.5.
- Product
- neko
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management.CVE-2026-116677 · Other software · openwisp · reported by GitHubMedium 5.3
OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's certificate revocation list by requesting its sequential CA identifier. CrlDownloadView.retrieve resolves the CA directly instead of using the organization-scoped object retrieval enforced by FilterByOrganizationManaged, bypassing the endpoint's intended authorization boundary. The response can disclose CA issuer information and revoked certificate serial numbers, but it does not expose CA private keys or allow modification. This issue is fixed in version 1.3.2.
- Product
- openwisp-controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.CVE-2026-108333 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Low 2.5
Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.CVE-2026-108332 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.3
Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.CVE-2026-108331 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Low 3.3
Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.CVE-2026-108330 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Low 3.6
Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.CVE-2026-108326 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension.CVE-2026-108309 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 5.5
Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed a heap-based buffer overflow vulnerability in Index.CVE-2026-108307 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.8
Tanium addressed a heap-based buffer overflow vulnerability in Index.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-108306 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.8
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-108305 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.8
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-108304 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.8
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3.CVE-2026-102815 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 6.9
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the TDDPv1 service and execute operating-system commands with root privileges. Successful exploitation may allow a local attacker with low privileges to obtain root privileges and execute arbitrary operating-system commands on the affected device.
- Product
- RE305 v3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Oct 27, 2026A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5.CVE-2026-102812 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 6.9
A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component. An attacker who obtains an affected configuration backup file may extract the cryptographic material from the firmware and use it to decrypt the backup. Successful exploitation may disclose sensitive configuration information contained in a backup file, including administrator passwords and Wi-Fi credentials.
- Product
- RE305 v3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Oct 27, 2026A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user.CVE-2026-87897 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.6
A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim's Whiteboard.
- Product
- whiteboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the tablCVE-2026-82983 · Other software · Nextcloud · reported by support@hackerone.comLow 3.3
The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels. This does not expose the table's data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels.
- Product
- Tables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidenCVE-2026-77173 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.3
A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.
- Product
- Files Confidential
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026App passwords were allowed to bypass password confirmation on sensitive endpoints.CVE-2026-77172 · Other software · Nextcloud · reported by support@hackerone.comMedium 5.3
App passwords were allowed to bypass password confirmation on sensitive endpoints.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table.CVE-2026-77167 · Other software · Nextcloud · reported by support@hackerone.comHigh 7.5
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.
- Product
- server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57201 · Other software · asterisk · reported by GitHubHigh 7.5
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 `ooTrace()` trace-logging function can occur when unbounded `vsprintf` writes into a fixed `2048-byte buffer`. A remote attacker may send a carefully crafted packet that causes the Asterisk process to crash. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57198 · Other software · asterisk · reported by GitHubLow 2.3
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57197 · Other software · asterisk · reported by GitHubHigh 7.7
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `memcpy` of `OGG/Speex` packet data in `format_ogg_speex` can cause a heap buffer overflow and crash Asterisk when reading a file containing corrupted Speex audio. The attacker must create the file and make it available to Asterisk either through sufficiently elevated privileges or by convincing an Asterisk administrator to make it available. Asterisk must also be configured to play that file. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57194 · Other software · asterisk · reported by GitHubMedium 5.9
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an out-of-bounds write in `chan_unistim` `DIALPAGE` digit handling can overflow the `phone_number` field and crash Asterisk when an attacker sends a carefully crafted incoming request packet. The `chan_unistim` module must be loaded and configured with a valid `UNISTIM UDP port` that the attacker can reach. The attacker must register as a configured `phone MAC`, or the deployment must have an equivalent `production/autoprovisioning` path that allows the client to reach the main page. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57189 · Other software · asterisk · reported by GitHubLow 2.3
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during `generation accumulation` using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Asterisk is an open source private branch exchange and telephony toolkit.CVE-2026-57185 · Other software · asterisk · reported by GitHubMedium 6.5
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the `PJSIP MWI body parser` by sending a carefully crafted `SIP NOTIFY` request. The attacker must pass SIP authentication using either a username/password or `source IP address matching`. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2026-48380 · Other software · Adobe · reported by AdobeMedium 5.5
Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe Substance 3D Painter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A vulnerability was found in oretnom23 php-travel-agency-system.CVE-2026-117512 · Other software · oretnom23 · reported by VulDBMedium 5.5
A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- php-travel-agency-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026systeminformation is a System and OS information library for node.js.CVE-2026-116674 · Other software · sebhildebrandt · reported by GitHubMedium 6.5
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object _network cache and indexes it with the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own cache entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and their values come from interface statistics, but inherited-name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior. This issue is fixed in version 5.33.13.
- Product
- systeminformation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026systeminformation is a System and OS information library for node.js.CVE-2026-116673 · Other software · sebhildebrandt · reported by GitHubLow 3.3
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.
- Product
- systeminformation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Authlib is a Python library which builds OAuth and OpenID Connect servers.CVE-2026-116672 · Other software · authlib · reported by GitHubHigh 8.8
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.
- Product
- authlib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond theCVE-2026-114598 · Other software · The EPICS Community · reported by ics-cert@hq.dhs.govHigh 8.7
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.
- Product
- EPICS Base
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond theCVE-2026-114597 · Other software · The EPICS Community · reported by ics-cert@hq.dhs.govHigh 8.7
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.
- Product
- EPICS Base
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in anCVE-2026-114596 · Other software · The EPICS Community · reported by ics-cert@hq.dhs.govHigh 8.8
In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.
- Product
- EPICS Base
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size.CVE-2026-114595 · Other software · The EPICS Community · reported by ics-cert@hq.dhs.govCritical 9.3
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.
- Product
- EPICS Base
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can triggCVE-2026-113775 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to execute arbitrary code in the context of the current process.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.appstreaming.autodesk.comdl.appstreaming.autodesk.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.