Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12,720 results · page 24 of 255
Sep 8, 2026UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof address bar via a co-installed app.CVE-2026-87597 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.8
UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof address bar via a co-installed app. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 8, 2026Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information viaCVE-2026-87552 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.5
Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 8, 2026Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandboxCVE-2026-87528 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 8, 2026Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via a co-installed app.CVE-2026-87486 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4
Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via a co-installed app. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 8, 2026`OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability onCVE-2026-81192 · Other software · open-telemetry · reported by GitHubHigh 7
`OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the `host.id` resource attribute detector launches the `sh` and `ioreg` executables by bare name rather than by absolute path, so both are resolved through the `PATH` environment variable. A local attacker who is less privileged than the host application, and who can influence `PATH` or write to a directory that appears in `PATH` ahead of the system directories, can have an arbitrary binary executed in the application's security context, resulting in local code execution/privilege escalation. This vulnerability only affect macOS hosts - Linux and Windows hosts are unaffected. Version 1.16.0-beta.2 contains a patch. No known workarounds are available.
- Product
- opentelemetry-dotnet-contrib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Acrobat Reader is affected by an Untrusted Search Path vulnerability that could result in privilege escalation.CVE-2026-80159 · Email & office · Adobe · reported by AdobeMedium 4
Acrobat Reader is affected by an Untrusted Search Path vulnerability that could result in privilege escalation. An attacker with high privileges could leverage this vulnerability to gain elevated access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe Acrobat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field.CVE-2026-78552 · Other software · Okta · reported by psirt@okta.comMedium 6
The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives.
- Product
- Okta Access Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-75992 · Other software · Adobe · reported by AdobeHigh 7.8
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Illustrator Desktop 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-75991 · Other software · Adobe · reported by AdobeHigh 8.6
Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
- Product
- Illustrator Desktop 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Illustrator is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-75990 · Other software · Adobe · reported by AdobeHigh 8.6
Illustrator is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
- Product
- Illustrator Desktop 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion.CVE-2026-28633 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion.CVE-2026-28617 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy.CVE-2026-28603 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion.CVE-2026-28596 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.CVE-2026-83939 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 26H1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.CVE-2026-83498 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.CVE-2026-81385 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker to execute code locally.CVE-2026-80083 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker to execute code locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-78451 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows an unauthorized attacker to elevate privileges with a physical attack.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.CVE-2026-78444 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.CVE-2026-77908 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
- Product
- Microsoft Dynamics 365 Customer Engagement V9.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-77484 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
- Product
- Microsoft SQL Server 2019 (CU 32)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.CVE-2026-73010 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network.CVE-2026-72989 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.CVE-2026-72956 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Double free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally.CVE-2026-71338 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.4
Double free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted pointer dereference in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.CVE-2026-69900 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted pointer dereference in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Windows Virtual Trusted Platform Module allows an authorized attacker to elevate privileges locally.CVE-2026-69890 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Use after free in Windows Virtual Trusted Platform Module allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted pointer dereference in Windows ALPC allows an authorized attacker to elevate privileges locally.CVE-2026-69874 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
Untrusted pointer dereference in Windows ALPC allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted search path in Windows Smart Card allows an authorized attacker to elevate privileges locally.CVE-2026-69785 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted search path in Windows Smart Card allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted pointer dereference in Windows Group Policy allows an authorized attacker to elevate privileges over a network.CVE-2026-69717 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Untrusted pointer dereference in Windows Group Policy allows an authorized attacker to elevate privileges over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Deserialization of untrusted data in Windows IP Address Management (IPAM) Service allows an authorized attacker to elevate privileges locally.CVE-2026-69694 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Deserialization of untrusted data in Windows IP Address Management (IPAM) Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted pointer dereference in Windows Print Spooler Components allows an authorized attacker to deny service over a network.CVE-2026-69569 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.7
Untrusted pointer dereference in Windows Print Spooler Components allows an authorized attacker to deny service over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.CVE-2026-69501 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted pointer dereference in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.CVE-2026-69475 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted pointer dereference in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-69328 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-67378 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9
Untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft SQL Server 2019 (CU 32)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.CVE-2026-65772 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
- Product
- Microsoft Dynamics 365 (on-premises) version 9.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.CVE-2026-62895 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Arc SQL Server Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-47297 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft SQL Server 2019 (CU 32)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker CVE-2026-84389 · Network & remote access · Fortinet · reported by psirt@fortinet.comLow 3.1
A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
- Product
- FortiSIEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Sep 8, 2026An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process.CVE-2026-82075 · Other software · MongoDB · reported by cna@mongodb.comHigh 8.7
An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to legitimate clients. No authentication, elevated privileges, or user interaction is required. Only availability is affected; data confidentiality and integrity are not impacted.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greatCVE-2026-86738 · Other software · grokability · reported by VulnCheckCritical 9.3
Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url() references to exfiltrate CSRF tokens from other superusers via attribute-selector rules, enabling account takeover.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the CustomizeUser plugin endCVE-2026-86719 · Other software · WWBN · reported by VulnCheckMedium 5.3
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes users_id from $_REQUEST and invokes User::swapUser() without calling forbidIfNotPost() or forbidIfInvalidToken(), and the global autoCSRFGuard() check only runs for POST requests to *.json.php, so the action is reachable via GET. An attacker who causes an authenticated administrator's browser to issue a cross-origin GET (for example via an <img> tag or link) can replace that administrator's session with a non-admin user account, causing the administrator to lose administrative access until the swap is cancelled; swapping to another administrator account is rejected, so this is not privilege escalation. The JSON response also discloses the session_id. The CustomizeUser plugin is enabled by default, and no patch was available at the time of publication.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 8, 2026A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code onCVE-2026-12745 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Critical 9.8
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
- Product
- Neurons for ITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code onCVE-2026-12744 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Critical 9.8
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
- Product
- Neurons for ITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on tCVE-2026-12651 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 8.8
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- Product
- Neurons for ITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on tCVE-2026-12650 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Critical 9.9
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- Product
- Neurons for ITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on tCVE-2026-12648 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 8.8
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- Product
- Neurons for ITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Content Extractor contained a deserialization of untrusted data issue affecting privilege management.CVE-2026-77092 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333High 7.3
Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.
- Product
- Commvault Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.