Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,621 results · page 22 of 93
May 28, 2026Synapse is an open source Matrix homeserver implementation.CVE-2026-45076 · Other software · element-hq · reported by GitHubMedium 5.1
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026EspoCRM is an open source customer relationship management application.CVE-2026-41160 · Other software · espocrm · reported by GitHubMedium 4.3
EspoCRM is an open source customer relationship management application. Prior to 9.3.5, a business logic flaw (Broken Access Control) in EspoCRM 9.3.3 allows low-privileged users to pin arbitrary notes without having the required edit permissions for the parent object. Due to a "write first, authorize later" execution flaw in the backend API, even though the server correctly returns a 403 Forbidden error, the targeted note's pinned status is already persistently modified in the database. The root cause lies in the server-side processing of the POST /api/v1/Note/{id}/pin endpoint. In application/Espo/Tools/Stream/Api/PostNotePin.php, the process() method first calls getNote($id) before calling checkParent($note). This vulnerability is fixed in 9.3.5.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026EspoCRM is an open source customer relationship management application.CVE-2026-41141 · Other software · espocrm · reported by GitHubMedium 6.5
EspoCRM is an open source customer relationship management application. Prior to 9.3.5, the POST /api/v1/EmailTemplate/:id/prepare endpoint accepts an emailAddress parameter and resolves the owning entity (Contact, Lead, Account, or User) without performing an ACL check. An authenticated user with EmailTemplate read permission can extract all field values of any entity by supplying the target's email address, bypassing read: own or read: team ACL restrictions. This vulnerability is fixed in 9.3.5.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026TinyMCE is an open source rich text editor.CVE-2026-47762 · Other software · tinymce · reported by GitHubHigh 8.7
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.
- Product
- tinymce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026TinyMCE is an open source rich text editor.CVE-2026-47761 · Other software · tinymce · reported by GitHubHigh 8.7
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.
- Product
- tinymce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026TinyMCE is an open source rich text editor.CVE-2026-47760 · Other software · tinymce · reported by GitHubHigh 8.7
TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0.
- Product
- tinymce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026TinyMCE is an open source rich text editor.CVE-2026-47759 · Other software · tinymce · reported by GitHubHigh 8.7
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.
- Product
- tinymce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.CVE-2026-8915 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comHigh 8.8
Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 36f5fb58366a67b713c02f6fd985e924fcc09e31.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-42877 · Other software · NeoRazorX · reported by GitHubMedium 5.4
FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales (Core/Lib/AjaxForms/SalesModalHTML.php) and purchases documents (Core/Lib/AjaxForms/PurchasesModalHTML.php). An authenticated user with access to the warehouse module can create a product with a malicious reference that executes arbitrary JavaScript in the browser of any other user who opens the product search modal inside an invoice, order, or delivery note.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-42879 · Other software · NeoRazorX · reported by GitHubMedium 6.3
FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-42878 · Other software · NeoRazorX · reported by GitHubMedium 5.3
FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including any database credentials, API keys, or application secrets set as env vars), filesystem paths, and loaded extensions without being authenticated. This vulnerability is fixed in v2026.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Twenty is an open source CRM.CVE-2026-46624 · Other software · twentyhq · reported by GitHubCritical 9.9
Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the database server by injecting SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint. The timeZone field within the group_by query parameter is directly interpolated into a raw SQL expression using JavaScript template literals without any parameterization, validation, or escaping. This affects engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts.
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables.CVE-2026-44730 · Other software · OpenCTI-Platform · reported by GitHubHigh 7.2
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges, to their own organization. This is due to incorrect ACL on userEdit relationAdd. This vulnerability is fixed in 6.9.7.
- Product
- opencti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Twenty is an open source CRM.CVE-2026-44729 · Other software · twentyhq · reported by GitHubHigh 8.7
Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStream.pipe(res) without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an authenticated attacker to upload an HTML file containing JavaScript, which will be rendered by the victim's browser in the context of the Twenty CRM domain when accessed — enabling session hijacking, account takeover, and data theft.
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Traccar is an open source GPS tracking system.CVE-2026-44314 · Other software · traccar · reported by GitHubMedium 5.3
Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.Permission(User.class, getUserId(), Device.class) and then immediately streams the uploaded body into mediaManager.createFileStream(...). Unlike the generic mutation path in BaseObjectResource.update and the explicit device mutation handler updateAccumulators, this route never invokes permissionsService.checkEdit(getUserId(), Device.class, false, false). The skipped guard is exactly where Traccar enforces readonly and deviceReadonly restrictions for non-admin users. An unauthorized user can replace a device’s stored image file under the server media directory. This allows modification of UI-visible device media and any downstream workflows that rely on the persisted image, despite other device update paths correctly rejecting the same identity. This vulnerability is fixed in 6.13.0.
- Product
- traccar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026RT is an open source, enterprise-grade issue and ticket tracking system.CVE-2026-41076 · Other software · bestpractical · reported by GitHubHigh 8.1
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.9 and prior in addition to 6.0.0 through 6.0.2 contain an authentication bypass vulnerability in RT installations that use LDAP/AD for user authentication. Under certain LDAP server configurations, an attacker may be able to authenticate as any LDAP-backed RT user without supplying valid credentials. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by reviewing their LDAP server's authentication policy to ensure it rejects unauthenticated bind attempts. Upgrading RT remains the recommended fix.
- Product
- rt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026RT is an open source, enterprise-grade issue and ticket tracking system.CVE-2026-41075 · Other software · bestpractical · reported by GitHubHigh 8.8
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 contain an SQL injection vulnerability. An authenticated user can craft input that is incorporated into database queries without proper validation, potentially allowing them to read or modify data in the RT database. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by restricting RT account access to trusted users.
- Product
- rt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026RT is an open source, enterprise-grade issue and ticket tracking system.CVE-2026-41074 · Other software · bestpractical · reported by GitHubHigh 7.1
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 through 6.0.2 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker who can induce a logged-in RT user to visit a malicious web page can trigger arbitrary state-changing actions in RT on that user's behalf. This issue has been fixed in version 6.0.3.
- Product
- rt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026RT is an open source, enterprise-grade issue and ticket tracking system.CVE-2026-41073 · Other software · bestpractical · reported by GitHubMedium 4.6
RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.
- Product
- rt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-40607 · Other software · mantisbt · reported by GitHubHigh 7.5
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.11.0 through 2.28.1, a Stored XSS vulnerability is caused by incorrect escaping of a saved filter's owner, allowing an attacker to inject arbitrary HTML on systems where $g_show_user_realname = ON. Note that By default, only users with Manager access level or above can save their filters publicly. This issue has been fixed in version 2.28.2. If developers are unable to update immediately, they can work around this issue by preventing display of users' real names (set $g_ show_user_realname = OFF; in configuration), and restricting the ability to store filters (set $g_stored_query_create_threshold / $g_stored_query_create_shared_threshold to NOBODY).
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-40598 · Other software · mantisbt · reported by GitHubMedium 6.9
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, improper escaping of the redirection page (retrieved from the request's Referer header) allows an attacker to inject HTML. While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting. This issue has been fixed in version 2.28.2.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-40597 · Other software · mantisbt · reported by GitHubHigh 7.6
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's script-src directive by uploading a crafted attachment to any issue that, when accessed via the file_download.php link, will be downloaded with a valid JavaScript MIME type resulting in script execution. The uploaded payload must be sniffed as a valid JavaScript MIME type by PHP finfo (see file_create_finfo() API function). Non-JavaScript MIME types will not get imported in a <script> tag by the browser, due to response header X-Content-Type-Options being set to nosniff, which requires all imported JavaScript files to be a valid JavaScript MIME type. This issue has been fixed in version 2.28.2.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-40596 · Other software · mantisbt · reported by GitHubHigh 7.2
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.11.0 through 2.28.1 allow any authenticated user to inject arbitrary HTML by updating their account's font family. Upon exploitation, an XSS payload would be reflected on every MantisBT page. Leveraging another vulnerability (CSP bypass, see GHSA-9c3j-xm6v-j7j3), the attacker could achieve account takeover. This issue has been fixed in version 2.28.2.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.CVE-2026-9256 · Network & remote access · F5 · reported by f5sirt@f5.comCritical 9.2
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-39960 · Other software · mantisbt · reported by GitHubMedium 5.4
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and below contain flawed logic that causes improper escaping of a textarea custom field's contents in the Update Issue page, (bug_update_page.php) allowing an attacker to inject HTML and, if CSP settings permit, execute arbitrary JavaScript when the page is loaded. This facilitates session theft, leading to admin account takeover, full project data access. In order to exploit this issue, a textarea-type custom field must be configured for the project, the attack must be carried out by an authenticated user with bug report permission (low privilege). This can affect any user viewing the bug edit form, including administrators. The issue has been fixed in version 2.28.2. If users cannot immediately upgrade, they can work around the issue by using the default Content-Security Policy, which blocks script execution.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-34970 · Other software · mantisbt · reported by GitHubMedium 5.3
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow a bugnote author to access the note's Revisions page after losing access to the parent private issue. This issue has been fixed in version 2.28.2.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-34754 · Other software · mantisbt · reported by GitHubMedium 4.3
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow an authenticated user to upload attachments to private Issues they are not authorized to access. This issue has been fixed in version 2.28.2.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-34744 · Other software · mantisbt · reported by GitHubMedium 5.3
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior permit a user to list and download their own attachments from an Issue created by another user even after it becomes private, bypassing read access revocation. The loss of confidentiality caused by this vulnerability is minimal, considering that only attachments previously uploaded by the user themselves remain accessible. This issue has been fixed in version 2.82.2.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks.CVE-2026-34600 · Other software · laurent22 · reported by GitHubMedium 5.7
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.5.2 and prior contain a logic error in the delta API that allows share recipients to download notes that are no longer shared with them, related to but not fully fixed by the prior patch in #14289. In ChangeModel.delta, when DELTA_INCLUDES_ITEMS is enabled (the default), the latest state of items is attached to delta output without verifying that those items are still shared with the requesting user, and the existing removal logic only filters items deleted for all users. Additionally, the change compression logic incorrectly reduces create - delete to NOOP, which is unsafe because compression is applied per page and an item can have multiple create events; if an earlier create falls on a separate page from a later create -> delete pair, the deletion is dropped and the sequence collapses to a create. As a result, the delta API returns a create event for a deleted item with the full latest content attached, exposing notes the user no longer has access to. This issue has been fixed in version 3.5.3.
- Product
- joplin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-34579 · Other software · mantisbt · reported by GitHubMedium 5.3
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior are vulnerable to Authorization Bypass through the private issue monitoring feature . Using a crafted POST request to bug_monitor_add.php, a user with project-level access can add themselves as a monitor for a private issue they do not have access to. Despite displaying an Access Denied error, the application accepts the request and creates a monitor relationship for the private issue. Direct access to the private issue remains blocked, but the user will receive email notifications for updates, leading to disclosure of the private issue's metadata and content. This issue has been fixed in version 2.28.2.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-34463 · Other software · mantisbt · reported by GitHubHigh 8.6
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior contain a Stored XSS vulnerability. When cloning an issue originating from a Project other than the current one, the clone form (bug_report_page.php) prepends the source Project name before the category selector without proper escaping, allowing an attacker able to to inject HTML if they can set the Project's name (which typically requires manager or administrator access level). This issue has been resolved in version 2.28.2.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-34390 · Other software · mantisbt · reported by GitHubMedium 5.1
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior have a Privilege Escalation vulnerability where insufficient access control checks in ProjectUsersAddCommand (manage_proj_user_add.php) allow users having manage_project_threshold access level (manager by default) to grant project-level administrator access to any user (including themselves) in any Project they have manager rights in. The normal project-user add form restricts the selectable access levels to the actor's own project role or below. However, the backend handler still accepts a forged higher access_level value and writes it. The consequences of the privilege escalation are slight, as having administrator access at Project level is effectively not very different from being manager, and it does not actually give administrator privileges on the whole MantisBT instance. In particular, it does not let the upgraded user delete the Project or grant them any access to global administrative functions such as managing Users, Projects, Plugins, Custom Fields, etc. This issue has been fixed in version 2.28.2.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks.CVE-2025-57798 · Other software · laurent22 · reported by GitHubMedium 5.5
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain a Denial of Service (DoS) vulnerability in the title input functionality due to a lack of proper length validation. This flaw allows an attacker to cause an Out Of Memory (OOM) error and subsequent program termination by inserting an excessively long string into a note's title. This can be triggered either through direct user interface (UI) input or programmatically via the local web service API after compromising an authentication token. There are 2 primary methods of exploitation: via User Interface (UI) Input, and the Local Web Service API. A local user can directly type or paste an extremely long string into the title field when creating or editing a note Joplin runs a local web service (typically on port 41184) that allows programmatic interaction, such as creating or editing notes via HTTP API calls. If an attacker manages to exfiltrate or compromise the user's authentication token (e.g., through malware on the local system, or other local vulnerabilities), they can then send a crafted HTTP POST request to this local API. By including an
- Product
- joplin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026EspoCRM is an open source customer relationship management application.CVE-2026-33741 · Other software · espocrm · reported by GitHubMedium 6.8
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below allow authenticated users to upload SVG attachments through normal attachment-capable fields and later serve those SVG files as top-level inline documents through both the attachment and image entry points, resulting in stored cross-user XSS reachable through a normal attachment workflow. Although inline SVG script is blocked by the response CSP, the same CSP still allows same-origin external script. As a result, an attacker can upload a malicious SVG together with a second attacker-controlled JavaScript attachment, then trick another user into opening the SVG to execute JavaScript in the victim's EspoCRM origin. This issue has been fixed in version 9.3.4.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation.CVE-2026-47317 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Improper Check or Handling of Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation.CVE-2026-47316 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
Improper Check or Handling of Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Improper Check for Unusual or Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation.CVE-2026-47315 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
Improper Check for Unusual or Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.CVE-2026-47314 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comHigh 7.8
Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Memory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation.CVE-2026-47313 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
Memory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Release of invalid pointer or reference vulnerability in Samsung Open Source Escargot allows Buffer Manipulation.CVE-2026-47312 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
Release of invalid pointer or reference vulnerability in Samsung Open Source Escargot allows Buffer Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.CVE-2026-47311 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comHigh 7.8
Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.CVE-2026-47310 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comHigh 7.8
Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads.CVE-2026-47309 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026NULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation.CVE-2026-47308 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
NULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation. This issue affects Walrus: f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9.
- Product
- Walrus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via a crafted WebAssembly module containingCVE-2026-47307 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via a crafted WebAssembly module containing deeply nested instructions. This issue affects Walrus: f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9.
- Product
- Walrus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-33052 · Other software · mantisbt · reported by GitHubMedium 5.3
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_threshold" permission to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request. This issue has been fixed in version 2.28.2.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-27964 · Other software · NeoRazorX · reported by GitHubLow 3.9
FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability through the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization. The fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect. This issue has been fixed in version 2025.8.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-27892 · Other software · NeoRazorX · reported by GitHubMedium 6.5
FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores and serves uploaded images byte-for-byte, without stripping EXIF/XMP/IPTC metadata. Any authenticated user who downloaded an image could extract the uploader's embedded metadata, which included GPS coordinates, device information, timestamps, embedded comments/notes, thumbnail previews, and other personally identifiable information (PII) preserved in the image metadata. Of all FacturaScripts' image upload features, only the Library module combined unrestricted uploads, persistent storage, authenticated download access, and a total lack of server-side metadata sanitization. This vulnerability carries significant real-world impact: an employee uploading a photo taken at their home inadvertently discloses their precise home address to every user with Library download access. This issue has been fixed in version 2026.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-27891 · Other software · NeoRazorX · reported by GitHubHigh 7.2
FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins::add() function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory. The vulnerability is located in Plugins.php. While the testZipFile function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that folder. An attacker can bypass this check by naming a file ValidPluginName/../../shell.php. The explode function will see ValidPluginName as the root folder, satisfying the count($folders) != 1 check. However, during extraction, the ../../ sequence triggers a path traversal, allowing the file to be written anywhere the web server has permissions the root directory. This issue is fixed in version 2026.1.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026FreePBX is an open source IP PBX.CVE-2026-26978 · Other software · FreePBX · reported by GitHubHigh 8.6
FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore operations, potentially leading to compromise if the backup contains carefully crafted hostile data. During backup restore operations, FreePBX extracts selected files from a user-supplied tar archive. If a malicious file exists in the archive, it is read and passed directly to unserialize() without validation, class restrictions, or integrity checks. This issue allows Remote Code Execution during restoration of the backup as the web server user (typically asterisk or www-data). The attack does not require shell access, CLI access, or filesystem write permissions beyond the normal restore workflow. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This issue has been fixed in versions 16.0.71 and 17.0.6.
- Product
- security-reporting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.