Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
330,945 results · page 21 of 6619
Nov 5, 2026All In One Login: Does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email loginCVE-2026-19256 · WordPress plugins & themes · reported by WPScanCritical 9.8
The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.
- Product
- All In One Login
- Fixed in
- 2.5.0
- What to do
- Update All In One Login to 2.5.0 or newer.
Nov 5, 2026WP Event Manager: Does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend formsCVE-2026-16304 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.
- Product
- WP Event Manager
- Fixed in
- 3.4.2
- What to do
- Update WP Event Manager to 3.4.2 or newer.
Nov 5, 2026iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the priCVE-2026-123014 · Other software · iTerm2 · reported by MITREHigh 8.7
iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in iTerm2. Percent-encoded NUL characters survive input sanitization and are subsequently converted to whitespace during command-line parsing, allowing injection of additional arguments to /usr/bin/man. An attacker can inject the -P option to select an attacker-controlled pager command. NOTE: this issue exists because of an incomplete fix for CVE-2023-46321.
- Product
- iTerm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026CatFolders: Does not have authorisation checks on a folder maintenance actionCVE-2026-107787 · WordPress plugins & themes · reported by WPScanLow 3.1
The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting.
- Product
- CatFolders
- Fixed in
- 2.5.7
- What to do
- Update CatFolders to 2.5.7 or newer.
Nov 5, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller statusCVE-2026-107775 · WordPress plugins & themes · reported by WPScanLow 2.7
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.
- Product
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Fixed in
- 5.3.3
- What to do
- Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.3.3 or newer.
Nov 5, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not correctly verify authorizationCVE-2026-107773 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.
- Product
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Fixed in
- 5.3.3
- What to do
- Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.3.3 or newer.
Nov 5, 2026Car Dealer (Dealership) and Vehicle sales: Does not restrict its unauthenticated single-listing AJAX action to published contentCVE-2026-105971 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.
- Product
- Car Dealer (Dealership) and Vehicle sales
- Affected
- up to 4.73
- What to do
- Affects up to 4.73. Update Car Dealer (Dealership) and Vehicle sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2026Cloud Blocks: Does not perform any authorisation or sanitisationCVE-2025-15702 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor.
- Product
- Cloud Blocks
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Cloud Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2026Easy Social Icons: Does not sanitise and escape some of its settings before outputting them on front-end pagesCVE-2025-15701 · WordPress plugins & themes · reported by WPScanLow 3.5
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.
- Product
- Easy Social Icons
- Fixed in
- 4.0.3
- What to do
- Update Easy Social Icons to 4.0.3 or newer.
Nov 5, 2026LiteSpeed Cache: Unauthenticated disclosure of sensitive WooCommerce customer dataCVE-2026-93389 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Store API GET responses (/wc/store/v1/cart and /wc/store/v1/checkout) as PUBLIC cache objects and does not vary the cache on the Cart-Token or WooCommerce session. A shopper's personalized cart/checkout response is therefore served to any later, cookie-less and token-less client as an LSCache HIT. This makes it possible for unauthenticated attackers to read another shopper's billing and shipping details (name, company, street address, email, phone), cart contents and totals, and the shopper's live Cart-Token session JWT and nonce (enabling cart/checkout-session hijack), plus order_key on the checkout endpoint.
- Product
- LiteSpeed Cache
- Affected
- up to 7.9.1
- What to do
- Affects up to 7.9.1. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 5, 2026In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerabilitCVE-2026-123012 · Other software · Gogs · reported by MITREHigh 7.1
In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of a case-sensitivity desync between the authorization classifier and the request dispatcher: the gitHTTPIsPull function compares the Git action verb case-sensitively and defaults to pull (read access) for any unrecognized string, whereas the request dispatcher lowercases the same verb before routing it to the receive-pack handler. Capitalizing a single letter in the URL (e.g. info/Refs instead of info/refs, or git-receive-Pack instead of git-receive-pack) causes the classifier to misidentify a push as a pull, granting only read-level authorization, whereas the dispatcher routes it to the write handler. An authenticated read-only collaborator can exploit this to push to a private repository, creating, updating, or deleting refs.
- Product
- Gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is exceeded.CVE-2026-123011 · Other software · STMicroelectronics · reported by MITREMedium 4.2
STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is exceeded.
- Product
- st-mems-android-linux-sensors-hal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim.CVE-2026-123010 · Other software · twilio-labs · reported by MITREHigh 7.2
@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.
- Product
- netlify-okta-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2026Motors – Car Dealership & Classified Listings: File DeletionCVE-2026-116617 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because `stm_save_user_extra_fields()`, hooked to `personal_options_update`, writes the attacker-controlled `stm_dealer_logo_path` parameter directly to user meta without an ownership check binding the submitted path to the submitting user — unlike the `stm_payment_status` and `stm_lost_password_hash` fields, this field is not gated by a `manage_options` or `edit_users` capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete image files belonging to other users under `wp-content/uploads` — including other users' avatars, dealer logos, and uploaded media — by storing a crafted path via their own profile and then triggering `unlink()` through the become-dealer form on their author page. Note that the two path guards (`stm_mvl_is_path_within_uploads` and `stm_mvl_is_allowed_image_file`) do restrict the attack surface to files with an image extension that resolve within the uploads basedir; files outside that directory, such as `wp-config.php` or
- Product
- Motors – Car Dealership & Classified Listings
- Affected
- up to 1.4.128
- What to do
- Affects up to 1.4.128. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Nov 4, 2026A vulnerability has been found in OpenHands up to 1.24.0.CVE-2026-122236 · Other software · reported by VulDBLow 2.1
A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 1.25.0 will fix this issue. The name of the patch is c5efa3ae415def0a903c82d2b17b748e663b1995. Upgrading the affected component is recommended.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.CVE-2026-69068 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.
- Product
- Exynos Modem 5300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.CVE-2026-69044 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.
- Product
- Exynos 1580
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruptionCVE-2026-69043 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption
- Product
- Exynos 2200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of serviceCVE-2026-69025 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service
- Product
- Exynos 1480
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.CVE-2026-69006 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.
- Product
- Exynos 850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026Integer overflow in NPU driver parameter processing due to insufficient bounds checking.CVE-2026-69005 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
Integer overflow in NPU driver parameter processing due to insufficient bounds checking.
- Product
- Exynos 1480
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026Incorrect authorization in Samsung framework services due to missing permission checksCVE-2026-69002 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
Incorrect authorization in Samsung framework services due to missing permission checks
- Product
- Exynos 1580
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory corruption and lead to a denial of service coCVE-2026-68991 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory corruption and lead to a denial of service condition.
- Product
- Exynos 1480
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption, potentially leading to denial of serviceCVE-2026-68990 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption, potentially leading to denial of service or privilege escalation.
- Product
- Exynos 1480
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service.CVE-2026-68985 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service.
- Product
- Exynos 1280
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.CVE-2026-68984 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.
- Product
- Exynos 2100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026Improper handling of messages before AS security activation can cause unexpected behaviorCVE-2026-48186 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
Improper handling of messages before AS security activation can cause unexpected behavior
- Product
- Exynos 1280
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissionsCVE-2026-48183 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissions
- Product
- Exynos 1480
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of ServiceCVE-2026-48179 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service
- Product
- Exynos 1080
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.CVE-2026-48174 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.
- Product
- Exynos 1280
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In the NAS message handler, improper validation of the length field in NAS message causes memory corruptionCVE-2026-48173 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
In the NAS message handler, improper validation of the length field in NAS message causes memory corruption
- Product
- Exynos 850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In IMS stack, improper handling of SIP packets leads to Incorrect_Access_Control vulnerabilityCVE-2026-35495 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
In IMS stack, improper handling of SIP packets leads to Incorrect_Access_Control vulnerability
- Product
- Exynos 1080
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In the baseband, memory corruption during NAS packet processing can cause a denial of service.CVE-2026-35494 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
In the baseband, memory corruption during NAS packet processing can cause a denial of service.
- Product
- Exynos 1280
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation.CVE-2026-33972 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation.
- Product
- Exynos 1080
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.CVE-2026-33971 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.
- Product
- Exynos 850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service.CVE-2026-33969 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service.
- Product
- Exynos 850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow.CVE-2026-33965 · Computers, phones & browsers · Samsung Semiconductor · reported by a8bfbd5c-5645-475e-a8f4-6c140c17bd29
An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow.
- Product
- Exynos 1080
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.com
Nov 4, 2026In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field.CVE-2026-122992 · Other software · G4KLX · reported by MITRECritical 9.2
In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field.
- Product
- DStarGateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying hCVE-2026-122323 · Other software · kyverno · reported by VulnCheckHigh 8.7
Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayloadSize, causing admission controller OOM kills and denial of service.
- Product
- kyverno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Nov 4, 2026Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplyCVE-2026-122322 · Other software · kyverno · reported by VulnCheckHigh 8.7
Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.
- Product
- kyverno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Nov 4, 2026Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference strinCVE-2026-122321 · Other software · kyverno · reported by VulnCheckHigh 8.5
Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit workloads and move a registry tag can warm the cache with a signed image, repoint the tag, and have Kyverno admit the workload and use mutateDigest to pin the unverified digest.
- Product
- kyverno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Nov 4, 2026Kyverno before 1.19.2 contains a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namespaces by templating gCVE-2026-122320 · Other software · kyverno · reported by VulnCheckHigh 8.3
Kyverno before 1.19.2 contains a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namespaces by templating generate.clone or cloneList namespace values. Attackers can annotate a triggering ConfigMap so the background-controller copies a victim namespace's sensitive ConfigMap into the attacker's namespace, enabling cross-tenant data disclosure.
- Product
- kyverno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Nov 4, 2026Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an uncheckedCVE-2026-122319 · Other software · kyverno · reported by VulnCheckHigh 8.7
Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an unchecked type assertion. Attackers can submit resources whose JMESPath-evaluated values yield arrays of integers, booleans, or mixed types, triggering a panic that disrupts admission control and policy enforcement.
- Product
- kyverno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Nov 4, 2026Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certifCVE-2026-122318 · Other software · kyverno · reported by VulnCheckHigh 7.2
Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issuer OID, and sign malicious images that are admitted despite signer pinning.
- Product
- kyverno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Nov 4, 2026Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows namespaced tenants to mCVE-2026-122316 · Other software · kyverno · reported by VulnCheckHigh 8.4
Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows namespaced tenants to modify resources outside their namespace. Attackers can create a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace resources via CEL expressions, making the background-controller ServiceAccount strip Pod Security labels cluster-wide.
- Product
- kyverno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Nov 4, 2026Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attCVE-2026-122315 · Other software · kyverno · reported by VulnCheckHigh 8.7
Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under failurePolicy Ignore or crash-loop the reports-controller.
- Product
- kyverno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Nov 4, 2026Kyverno before 1.19.2 contains an unchecked type assertion in its variable-substitution engine that allows users who can submit resources to crash the policy enCVE-2026-122314 · Other software · kyverno · reported by VulnCheckHigh 8.7
Kyverno before 1.19.2 contains an unchecked type assertion in its variable-substitution engine that allows users who can submit resources to crash the policy engine. Attackers can submit resources with non-string fields referenced by {{- variable }} shallow substitution in policies, causing a panic that yields webhook denial of service and policy bypass under failurePolicy Ignore.
- Product
- kyverno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Nov 4, 2026Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in other namespaces thrCVE-2026-122313 · Other software · kyverno · reported by VulnCheckCritical 9.4
Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in other namespaces through NamespacedMutatingPolicy targetMatchConstraints.expression CEL output lacking namespace checks. Attackers can emit a literal target such as another tenant's RoleBinding, which the cluster-wide background controller then mutates to add attacker subjects or alter Roles, NetworkPolicies, and ConfigMaps.
- Product
- kyverno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Nov 4, 2026Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch() in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a pCVE-2026-122312 · Other software · kyverno · reported by VulnCheckHigh 8.3
Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch() in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can create namespaced policies can supply a URLPath like /api/v1/nodes?x=/namespaces/default/ that passes validation while client-go requests the cluster-scoped endpoint, reading resources outside their namespace.
- Product
- kyverno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policiCVE-2026-122311 · Other software · kyverno · reported by VulnCheckCritical 9.4
Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster objects using the admission controller's ServiceAccount, leading to cluster takeover.
- Product
- kyverno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.