Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
330,945 results · page 24 of 6619
Nov 4, 2026CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffersCVE-2026-122127 · Other software · CESNET · reported by VulnCheckHigh 8.7
CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffers. Attackers can declare a small ring buffer_size followed by a large decompressed_size to write up to 65535 controlled bytes and crash the collector.
- Product
- ipfixcol2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader(), which TurnTlsSocket inherits, that allows malicioCVE-2026-122126 · Other software · resiprocate · reported by VulnCheckHigh 8.2
reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader(), which TurnTlsSocket inherits, that allows malicious TURN servers or on-path attackers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the fixed 8192-byte mReadBuffer and crashing the client. Only the synchronous TCP and TLS client is affected; the asynchronous client (TurnAsyncSocket) and the reTurn server are not.
- Product
- resiprocate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27.CVE-2026-122014 · Other software · NPC-Worldwide · reported by VulDBLow 2.1
A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- npcpy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026A flaw has been found in DataLinkDC Dinky up to 1.2.5.CVE-2026-122009 · Other software · DataLinkDC · reported by VulDBMedium 5.5
A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flink_web Proxy Endpoint. This manipulation of the argument _authority causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.
- Product
- Dinky
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a CVE-2026-121969 · Other software · quozl · reported by VulnCheckHigh 7.1
netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client.
- Product
- netrek-client-cow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an uCVE-2026-121968 · Other software · quozl · reported by VulnCheckHigh 7.1
Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or more, reading past players[] and shipnos to deny service.
- Product
- netrek-client-cow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS aCVE-2026-11724 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.
- Product
- MQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS aCVE-2026-11376 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values.
- Product
- MQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct a phishing attack due to an open redirect vulnerability.CVE-2026-116376 · Other software · IBM · reported by psirt@us.ibm.comLow 3.4
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct a phishing attack due to an open redirect vulnerability.
- Product
- Db2 Genius Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026draw.io is a configurable diagramming and whiteboarding application.CVE-2026-115762 · Other software · jgraph · reported by GitHubMedium 6.1
draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype objects, and the decoder can then assign attacker-controlled attributes to those objects. Importing a malicious GraphML file can trigger client-side prototype pollution. In the advisory-supported cross-site scripting chain, the editor is opened in Trello mode and the user invokes the Trello integration after the import, allowing the polluted state to execute script in the draw.io origin; an existing Trello connection is not required. This vulnerability is fixed in 31.1.5.
- Product
- drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to cause a denial of service due to improper validation of user-influeCVE-2026-110283 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to cause a denial of service due to improper validation of user-influenced resource identifiers.
- Product
- Db2 Genius Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control.CVE-2026-110282 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control.
- Product
- Db2 Genius Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information usiCVE-2026-110281 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle technique.
- Product
- Db2 Genius Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS aCVE-2026-10859 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.
- Product
- MQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to missing required cryptographic CVE-2026-108910 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to missing required cryptographic step.
- Product
- Db2 Genius Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a local attacker to cause a denial of service due to uncontrolled resource consumption.CVE-2026-108838 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a local attacker to cause a denial of service due to uncontrolled resource consumption.
- Product
- Db2 Genius Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HCVE-2026-108767 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers.
- Product
- Db2 Genius Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing X-Content-Type-OptionCVE-2026-108588 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing X-Content-Type-Options header allowing MIME type sniffing.
- Product
- Db2 Genius Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper restriction of rendereCVE-2026-108536 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.6
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper restriction of rendered UI layers or frames.
- Product
- Db2 Genius Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing Content Security PoliCVE-2026-105991 · Other software · IBM · reported by psirt@us.ibm.comLow 3.5
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing Content Security Policy header.
- Product
- Db2 Genius Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to exposure of error messages contCVE-2026-105702 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to exposure of error messages containing internal implementation details.
- Product
- Db2 Genius Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026Telepresence enables local development against a remote Kubernetes or OpenShift cluster.CVE-2026-102340 · Other software · telepresenceio · reported by GitHubHigh 8.5
Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Namespace using only the ManagesNamespace manager watchlist check, and CreateIntercept can target any managed namespace without checking the session's Kubernetes RBAC. An attacker operating any pod with network access to the manager can register in an arbitrary managed namespace, create service intercepts, receive intercepted traffic, and obtain the victim pod's complete container environment, including secrets, tokens, and API keys. The default cluster-wide deployment manages all namespaces. This vulnerability is fixed in 2.31.0.
- Product
- telepresence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026Telepresence enables local development against a remote Kubernetes or OpenShift cluster.CVE-2026-102339 · Other software · telepresenceio · reported by GitHubHigh 8.2
Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0.
- Product
- telepresence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.pCVE-2025-71457 · Other software · vtenext · reported by VulnCheckCritical 9.3
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.
- Product
- vtenext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0xbro.redblog.sicuranext.com
Nov 4, 2026vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parCVE-2025-71456 · Other software · vtenext · reported by VulnCheckHigh 8.6
vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in vte_userauthtoken, to take over other user accounts.
- Product
- vtenext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0xbro.redblog.sicuranext.com
Nov 4, 2026vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web servicCVE-2025-71455 · Other software · vtenext · reported by VulnCheckMedium 5.9
vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions.
- Product
- vtenext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0xbro.redblog.sicuranext.com
Nov 4, 2026vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation fCVE-2025-71454 · Other software · vtenext · reported by VulnCheckMedium 6.9
vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read from $_REQUEST, performing actions as that user.
- Product
- vtenext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0xbro.redblog.sicuranext.com
Nov 4, 2026vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys froCVE-2025-71453 · Other software · vtenext · reported by VulnCheckMedium 5.1
vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim's vtenext session.
- Product
- vtenext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0xbro.redblog.sicuranext.com
Nov 4, 2026WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replaCVE-2026-122220 · WordPress plugins & themes · reported by VulnCheckCritical 9.1
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 4, 2026Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify FirecraCVE-2026-122192 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 7.1
Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the host fails to create the replacement mapping. To remediate this issue, users should upgrade to Firecracker 1.16.2 or 1.17.0 and later.
- Product
- firecracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Nov 4, 2026A flaw has been found in Linksys E5350 1.0.00.037.CVE-2026-121933 · Network & remote access · Linksys · reported by VulDBCritical 9.3
A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E5350
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability.CVE-2026-113374 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11High 8.6
Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability, which turns on header-based authentication for the instance. A remote client can then authenticate as an existing user, including an administrator, without credentials.
- Product
- Nexus Repository 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
Nov 4, 2026Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provideCVE-2026-113373 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11Critical 9.1
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.
- Product
- Nexus Repository 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
Nov 4, 2026Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administerinCVE-2026-113372 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11High 7.1
Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. A party that holds the key can sign repository metadata as that repository.
- Product
- Nexus Repository 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
Nov 4, 2026Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only theCVE-2026-113371 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11High 7.1
Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.
- Product
- Nexus Repository 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
Nov 4, 2026Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task.CVE-2026-113370 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11High 7.7
Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus database. The task is available only when the non-default setting nexus.reindex.search.by.pattern.visible is set to true.
- Product
- Nexus Repository 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
Nov 4, 2026Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repoCVE-2026-113369 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11Medium 6.3
Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user.
- Product
- Nexus Repository 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
Nov 4, 2026Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the repository is added as a member of a group reposiCVE-2026-113368 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11Medium 5.3
Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the repository is added as a member of a group repository. A user account that has signed in with valid credentials and holds the add or edit privilege on a group repository can add a repository that the account cannot read or browse, and then read the content of that repository through the group. The anonymous user can only do this if an administrator has explicitly granted it that privilege.
- Product
- Nexus Repository 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
Nov 4, 2026DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and WebSocket CVE-2026-82033 · Other software · deepseek-ai · reported by VulnCheckHigh 8.6
DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and WebSocket RPC control plane, allowing any local process, including those running as a different OS user, to reach unauthenticated session methods such as session.create and session.prompt. Attackers can invoke session.prompt to trigger the agent's bash and filesystem tools, achieve arbitrary command execution as the victim user using their configured model credentials, intercept live session traffic and logs over the event mux stream, and bypass human tool-approval checks via POST /api/respond by matching only rpcId, approvalId, and sessionId values broadcast over the ungated stream.
- Product
- deepseek-harness
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to otCVE-2026-82029 · Other software · invoiceninja · reported by VulnCheckHigh 7.1
Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company_id scope instead of vendor ownership. Attackers can request GET /vendor/documents/{hashid}/download or POST /vendor/documents/download_multiple, enumerating predictable sequential Hashids document identifiers due to a default empty HASH_SALT, to read any invoice PDFs, contracts, payment receipts, and expense attachments within the company.
- Product
- invoiceninja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026OmniAuth is a flexible authentication system utilizing Rack middleware.CVE-2026-63183 · Other software · omniauth · reported by GitHubMedium 6.9
OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured. A remote unauthenticated client can supply a forged Host header, creating a host header injection risk in applications whose web framework does not verify incoming host headers. Applications using appropriately configured Rails host authorization or a fixed full_host are not affected by this path. This issue is fixed in version 2.2.0.
- Product
- omniauth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability.CVE-2026-122148 · Other software · Yealink · reported by MITREHigh 8.2
In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot function by circumventing front-end interface restrictions. Exploitation can occur only when the attacker has a valid administrator account within the local network.
- Product
- MeetingBoard Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface.CVE-2026-122124 · Other software · Yealink · reported by MITREMedium 6.1
On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform audio and video eavesdropping with no LED alert from the device.
- Product
- UVC40 E2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers CVE-2026-122120 · Other software · Yealink · reported by MITRECritical 9
In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.
- Product
- Plug-in Softwares
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.yealink.comyealink.com
Nov 4, 2026A security vulnerability has been detected in Linksys WRT54GL 4.30.18.CVE-2026-121931 · Network & remote access · Linksys · reported by VulDBHigh 8.5
A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of the file apply.cgi of the component Traceroute Diagnostic Function. Such manipulation of the argument traceroute_ip leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- WRT54GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026A weakness has been identified in Linksys WRT54GL 4.30.18.CVE-2026-121930 · Network & remote access · Linksys · reported by VulDBHigh 8.5
A weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the function system of the file apply.cgi of the component Ping Diagnostic. This manipulation of the argument ping_ip causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- WRT54GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0.CVE-2026-121929 · Other software · EmpireSoft · reported by VulDBLow 2
A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. Impacted is an unknown function of the file /e/member/mspace/index.php. The manipulation of the argument spacename results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EmpireCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026ESP-IDF is the Espressif Internet of Things (IOT) Development Framework.CVE-2026-113783 · Other software · espressif · reported by GitHubHigh 7.4
ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup path in dns_lookup() in dns.c copies every cached address into a caller-provided single ip_addr_t output buffer without a length parameter or bounds check. When CONFIG_LWIP_DNS_MAX_HOST_IP is greater than 1 and a cached hostname has multiple A or AAAA records, a subsequent lookup through dns_gethostbyname() or dns_gethostbyname_addrtype() writes beyond the single-element buffer into adjacent stack memory. A network-positioned attacker who influences DNS responses can cause a reboot through stack-canary corruption or, without stack protection, overwrite stack variables with attacker-controlled address bytes and potentially redirect control flow. This issue is fixed in versions 5.5.6 and 6.0.3 and is scheduled to be fixed in versions 5.3.7 and 5.4.5. No fixed release is available for the end-of-life 5.2 line.
- Product
- esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026ESP-IDF is the Espressif Internet of Things (IOT) Development Framework.CVE-2026-113782 · Other software · espressif · reported by GitHubHigh 7.1
ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6 option length while copying into a fixed stack buffer. A host on the same infrastructure link as the Border Router can send a crafted ICMPv6 Router Advertisement to its infrastructure interface whose oversized length causes an out-of-bounds write into adjacent stack memory. Firmware is affected only when CONFIG_OPENTHREAD_BORDER_ROUTER=y; Thread end devices, routers, and RCP firmware without the Border Router feature are unaffected. Exploitation requires no authentication or user interaction and can crash or reboot the device or corrupt adjacent stack state. This issue is fixed in versions 5.2.8, 5.3.6, 5.5.5, and 6.0.3 and is scheduled to be fixed in version 5.4.5.
- Product
- esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2026ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.CVE-2026-113780 · Other software · espressif · reported by GitHubCritical 9.3
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary and potentially corrupting TEE control-flow data for code execution, denial of service, or system crashes. Both secure-service ecall and interrupt entry paths contain the vulnerable ordering. This issue is fixed in version 5.5.6 and is scheduled to be fixed in versions 6.0.4 and 6.1.1.
- Product
- esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.