Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,659 results · page 21 of 114
Jul 15, 2026File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.CVE-2026-62683 · Other software · filebrowser · reported by GitHubLow 3.1
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser can leave a public directory share behind when the shared directory is deleted through a path with a trailing slash because the share cleanup path calls DeleteWithPathPrefix(file.Path, userID) and the Bolt backend performs the database prefix query with the unnormalized path before trimming the slash for boundary checks, so deleting /a/ does not delete the stored /a share and the stale public share exposes future content if the same path is recreated. This issue is fixed in version 2.63.17.
- Product
- filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Zen is a firefox-based browser.CVE-2026-45150 · Other software · zen-browser · reported by GitHubMedium 6.3
Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode, allowing an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft. This issue is fixed in version 1.19.13b.
- Product
- desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data.CVE-2026-48125 · Other software · faisalman · reported by GitHubMedium 5.3
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.
- Product
- ua-parser-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Brokering File System allows an authorized attacker to elevate privileges locally.CVE-2026-50466 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Brokering File System allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.CVE-2026-50458 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.CVE-2026-50361 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.CVE-2026-50305 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.CVE-2026-49162 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repoCVE-2026-14504 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11High 8.2
An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check.
- Product
- Nexus Repository 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
Jul 14, 2026In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data_point field in PuCVE-2026-13699 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 4.3
In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data_point field in PublishValueRequest. When a request contains a valid signal_id but omits data_point, the server directly calls unwrap() on request.data_point, triggering a panic in the Tokio worker thread. This issue can be triggered by any client holding a valid JWT token. Unauthenticated or invalid-token requests are rejected and do not reach the vulnerable path. The panic causes the individual gRPC call to be cancelled but does not terminate the Databroker process, which remains available for subsequent requests.
- Product
- Eclipse KUKSA - Databroker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs.CVE-2026-62197 · Other software · OpenClaw · reported by VulnCheckMedium 6.3
OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 13, 2026Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basicCVE-2026-61504 · Other software · rejetto · reported by VulnCheckMedium 5.1
Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basic parameter. A user with upload permission - or an anonymous user on servers with an open upload folder - can store a file whose name contains script that executes in the browser of anyone viewing the listing.
- Product
- hfs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 13, 2026Brook: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57791 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.
- Product
- Brook
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update Brook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2026filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave staleCVE-2026-61874 · Other software · filebrowser · reported by VulnCheckLow 2.3
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.
- Product
- filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2026A flaw has been found in AMTT Hotel Broadband Operation System 1.0.CVE-2026-15494 · Other software · AMTT · reported by VulDBLow 2
A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switch_status.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Hotel Broadband Operation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2026The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assistant.c reassembled remote Broadcast Receive State data into a sinCVE-2026-10660 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgMedium 6.4
The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assistant.c reassembled remote Broadcast Receive State data into a single file-static net_buf_simple (att_buf, BT_ATT_MAX_ATTRIBUTE_LEN = 512 bytes) shared by all connection instances, while the BUSY flag, long-read handle, and reset/offset state were per-connection. When the device acts as a Broadcast Assistant connected to multiple Scan Delegator peripherals, notification and long-read callbacks from different connections interleave on the shared buffer: the append in notify_handler (net_buf_simple_add_mem at the not-busy branch) performs no tailroom check, so receive-state notifications from two or more delegators accumulate on the same 512-byte buffer and, with a sufficiently large configured ATT MTU (BT_L2CAP_TX_MTU up to 2000) and two-to-three concurrent connections, write past the buffer into adjacent .bss (net_buf_simple_add only asserts in debug builds). Even below the overflow threshold, one connection's net_buf_simple_reset zeroes the shared length while another connection's reassembly and GATT read offset are in flight, mixing one peer's data into another's parse. A malicious or
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing.CVE-2026-58590 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing.CVE-2026-58589 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing.CVE-2026-13241 · Websites & servers · reported by mlhess@drupal.orgMedium 6.5
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing.CVE-2026-13240 · Websites & servers · reported by mlhess@drupal.orgMedium 6.5
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing.CVE-2026-13239 · Websites & servers · reported by mlhess@drupal.orgMedium 6.5
Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing.CVE-2026-13238 · Websites & servers · reported by mlhess@drupal.orgMedium 4.8
Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payments versions: from 0.0.0 to 3.0.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing.CVE-2026-13237 · Websites & servers · reported by mlhess@drupal.orgMedium 4.8
Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing.CVE-2026-13236 · Websites & servers · reported by mlhess@drupal.orgMedium 4.2
Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.CVE-2026-13235 · Websites & servers · reported by mlhess@drupal.orgLow 3.3
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing.CVE-2026-13232 · Websites & servers · reported by mlhess@drupal.orgLow 3.1
Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing.CVE-2026-11909 · Websites & servers · reported by mlhess@drupal.orgLow 3.3
Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing.CVE-2026-10768 · Websites & servers · reported by mlhess@drupal.orgCritical 9.8
Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026RabbitMQ is a messaging and streaming broker.CVE-2026-57221 · Other software · rabbitmq · reported by GitHubMedium 5.3
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and exchange names and read queue message and consumer counts. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
- Product
- rabbitmq-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026RabbitMQ is a messaging and streaming broker.CVE-2026-57220 · Other software · rabbitmq · reported by GitHubHigh 7.5
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an unauthenticated remote client to declare oversized frame lengths and consume broker memory in rabbit_stream_core. This issue is fixed in version 4.2.6.
- Product
- rabbitmq-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026RabbitMQ is a messaging and streaming broker.CVE-2026-57219 · Other software · rabbitmq · reported by GitHubHigh 8.7
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
- Product
- rabbitmq-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026RabbitMQ is a messaging and streaming broker.CVE-2026-57218 · Other software · rabbitmq · reported by GitHubMedium 4.9
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.update_secret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after the channel user state changes. This issue is fixed in version 4.2.6.
- Product
- rabbitmq-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026RabbitMQ is a messaging and streaming broker.CVE-2026-57217 · Other software · rabbitmq · reported by GitHubHigh 7
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6, RabbitMQ topic authorization can allow restricted topic writes and binds during metadata-store failures because topic-permission lookup errors from Khepri can collapse to undefined, which the internal backend treats as allow. This issue is fixed in versions 3.13.15, 4.0.21, 4.1.11, and 4.2.6.
- Product
- rabbitmq-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026RabbitMQ is a messaging and streaming broker.CVE-2026-57216 · Other software · rabbitmq · reported by GitHubMedium 6.8
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend listener is loopback-bound because the loopback check uses the listener-side socket address instead of the real client source. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
- Product
- rabbitmq-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026RabbitMQ is a messaging and streaming broker.CVE-2026-57215 · Other software · rabbitmq · reported by GitHubHigh 7
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
- Product
- rabbitmq-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026RabbitMQ is a messaging and streaming broker.CVE-2026-57214 · Other software · rabbitmq · reported by GitHubHigh 7.1
RabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with permission to declare a queue or exchange to execute JavaScript in another user's browser. This issue is fixed in version 4.2.5.
- Product
- rabbitmq-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026RabbitMQ is a messaging and streaming broker.CVE-2026-57213 · Other software · rabbitmq · reported by GitHubMedium 5.7
RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute JavaScript in the browser of a user viewing that page. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.
- Product
- rabbitmq-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026RabbitMQ is a messaging and streaming broker.CVE-2026-57212 · Other software · rabbitmq · reported by GitHubHigh 7.1
RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.
- Product
- rabbitmq-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026RabbitMQ is a messaging and streaming broker.CVE-2026-57211 · Other software · rabbitmq · reported by GitHubMedium 6.5
RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multiple management extension plugins are enabled, causing outbound DNS and SMB requests to attacker-controlled UNC paths. This issue is fixed in versions 4.1.11 and 4.2.6.
- Product
- rabbitmq-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of anyCVE-2026-8595 · Other software · Grafana · reported by security@grafana.comMedium 6.8
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Zen is a firefox-based browser.CVE-2026-57501 · Other software · zen-browser · reported by GitHubNone
Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link to a file URL that can load with System privileges when opened through either context-menu item and bypass the content-to-file security check that blocks an ordinary click. This issue is fixed in version 1.21.5b.
- Product
- desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user.CVE-2026-0276 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comLow 1.1
A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user.
- Product
- Cortex XDR Broker VM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Jul 9, 2026A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated administrator with access to the macOS local filCVE-2026-0275 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comLow 2
A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated administrator with access to the macOS local filesystem to perform actions on the device with root privileges. This issue only affects Prisma® Browser on macOS.
- Product
- Prisma Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Jul 8, 2026Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authenticated sellers to manipulate purchase aCVE-2026-59805 · Other software · antiwork · reported by VulnCheckHigh 7.1
Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authenticated sellers to manipulate purchase access for other sellers' products by sending PUT requests to the revoke_access and undo_revoke_access actions without seller ownership validation. Attackers can modify the is_access_revoked status on arbitrary purchases to unauthorized revoke or restore buyer access to products they do not own.
- Product
- gumroad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026File Browser provides a web file managing interface.CVE-2026-55668 · Other software · filebrowser · reported by GitHubMedium 6.3
File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation, allowing an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user's scope. This issue is fixed in version 2.63.16.
- Product
- filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owCVE-2026-56246 · Other software · Capgo · reported by VulnCheckHigh 7.2
Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user's permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still perform destructive operations (e.g., DELETE /organization, DELETE /organization/members) against another organization. The root cause is route-level authorization (rbac_check_permission_direct) that evaluates the key owner's user privileges before enforcing the API key's limited_to_orgs scope.
- Product
- Capgo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 7, 2026Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other organizations without auCVE-2026-57870 · Other software · MicroRealEstate · reported by vdp@themissinglink.com.auMedium 5.3
Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other organizations without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3.
- Product
- MicroRealEstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthemissinglink.com.au
Jul 7, 2026Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uCVE-2026-57869 · Other software · MicroRealEstate · reported by vdp@themissinglink.com.auHigh 7.1
Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uploaded by landlords or tenants without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3.
- Product
- MicroRealEstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthemissinglink.com.au
Jul 7, 2026MicroRealEstate is affected by broken object-level access controls in PDF generator functionality.CVE-2026-57868 · Other software · MicroRealEstate · reported by vdp@themissinglink.com.auHigh 7.1
MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroRealEstate: through 1.0.0-alpha3.
- Product
- MicroRealEstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthemissinglink.com.au
Jul 6, 2026A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin CVE-2026-13356 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.3
A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 152.3.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.