Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

4,993 results · page 24 of 100

Feb 24, 2026The SPIP jeux plugin versions prior to 4.1.1 contain a reflected cross-site scripting (XSS) vulnerability in the pre_propre pipeline.CVE-2026-27746 · Other software · SPIP · reported by VulnCheckMedium 5.1
The SPIP jeux plugin versions prior to 4.1.1 contain a reflected cross-site scripting (XSS) vulnerability in the pre_propre pipeline. The plugin incorporates untrusted request parameters into HTML output without proper output encoding, allowing attackers to inject arbitrary script content into pages that render a jeux block. When a victim is induced to visit a crafted URL, the injected content is reflected into the response and executed in the victim's browser context.
Product
jeux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.spip.net chocapikk.com
Feb 23, 2026yt-dlp is a command-line audio/video downloader.CVE-2026-26331 · Other software · yt-dlp · reported by GitHubHigh 8.8
yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses `--netrc-cmd` in their command/configuration or `netrc_cmd` in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be trivial for a maliciously crafted webpage with an inconspicuous URL to covertly exploit this vulnerability via HTTP redirect. Users without `--netrc-cmd` in their arguments or `netrc_cmd` in their scripts are unaffected. No evidence has been found of this exploit being used in the wild. yt-dlp version 2026.02.21 fixes this issue by validating all netrc "machine" values and raising an error upon unexpected input. As a workaround, users who are unable to upgrade should avoid using the `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter), or they should at least not pass a placeholder (`
Product
yt-dlp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 22, 2026SQL Injection vulnerability in the /api/integrations/getintegrations endpoint of Order Up Online Ordering System 1.0 allows an unauthenticated attacker to accesCVE-2026-24494 · Other software · Order Up · reported by 66fe30d5-b042-4547-a192-c18da4c41a81Critical 9.8
SQL Injection vulnerability in the /api/integrations/getintegrations endpoint of Order Up Online Ordering System 1.0 allows an unauthenticated attacker to access sensitive backend database data via a crafted store_id parameter in a POST request.
Product
Online Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record spartanssec.com
Feb 22, 2026A security flaw has been discovered in Tosei Online Store Management System ネット店舗管理システム 1.01.CVE-2026-2944 · Other software · Tosei · reported by VulDBMedium 5.5
A security flaw has been discovered in Tosei Online Store Management System ネット店舗管理システム 1.01. Affected is the function system of the file /cgi-bin/monitor.php of the component HTTP POST Request Handler. Performing a manipulation of the argument DevId results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Product
Online Store Management System ネット店舗管理システム
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Feb 21, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-27574 · Other software · OneUptime · reported by GitHubCritical 9.9
OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm module (explicitly documented as not a security mechanism) to execute user-supplied code, allowing trivial sandbox escape via a well-known one-liner that grants full access to the underlying process. Because the probe runs with host networking and holds all cluster credentials (ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, CLICKHOUSE_PASSWORD) in its environment variables, and monitor creation is available to the lowest role (ProjectMember) with open registration enabled by default, any anonymous user can achieve full cluster compromise in about 30 seconds. This issue has been fixed in version 10.0.5.
Product
oneuptime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 20, 2026Timeline Event History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69384 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Timeline Event History timeline-event-history allows Reflected XSS.This issue affects Timeline Event History: from n/a through <= 3.2.
Product
Timeline Event History
Affected
up to 3.2
What to do
Affects up to 3.2. Update Timeline Event History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-26193 · Other software · open-webui · reported by GitHubHigh 7.3
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history allows setting the `embeds` property on a response message, the content of which is loaded into an iFrame with a sandbox that has `allow-scripts` and `allow-same-origin` set, ignoring the "iframe Sandbox Allow Same Origin" configuration. This enables stored XSS on the affected chat. This also triggers when the chat is in the shared format. The result is a shareable link containing the payload that can be distributed to any other users on the instance. Version 0.6.44 fixes the issue.
Product
open-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 19, 2026Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-26192 · Other software · open-webui · reported by GitHubHigh 7.3
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.7.0, aanually modifying chat history allows setting the `html` property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponized document payload in a chat. The payload also executes when the citation is viewed on a shared chat. Version 0.7.0 fixes the issue.
Product
open-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 19, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument Injection.This issue aCVE-2026-2409 · Other software · Delinea · reported by 1443cd92-d354-46d2-9290-d812316ca43aCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument Injection.This issue affects Cloud Suite: before 25.2 HF1.
Product
Cloud Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record delinea.com docs.delinea.com
Feb 19, 2026Orderable – WordPress Restaurant Online Ordering System and Food Ordering: Unauthorized plugin installationCVE-2026-0974 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the 'install_plugin' function in all versions up to, and including, 1.20.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary plugins, which can lead to Remote Code Execution.
Product
Orderable – WordPress Restaurant Online Ordering System and Food Ordering
Affected
up to 1.20.0
What to do
Affects up to 1.20.0. Update Orderable – WordPress Restaurant Online Ordering System and Food Ordering to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Delinea Inc.CVE-2025-12812 · Other software · Delinea Inc. · reported by 1443cd92-d354-46d2-9290-d812316ca43aMedium 5.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Delinea Inc. Cloud Suite and Privileged Access Service. Remediation: This issue is fixed in Cloud Suite: 25.1
Product
Cloud Suite and Privileged Access Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.delinea.com trust.delinea.com
Feb 18, 2026Improper Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Delinea Inc.CVE-2025-12811 · Other software · Delinea Inc. · reported by 1443cd92-d354-46d2-9290-d812316ca43aMedium 6.9
Improper Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Delinea Inc. Cloud Suite and Privileged Access Service. If you're not using the latest Server Suite agents, this fix requires that you upgrade to Server Suite 2023.1 (agent 6.0.1) or later. * If you cannot upgrade to Release 2023.1 (agent version 6.0.1) or later, you can choose one of the following versions: * Server Suite release 2023.0.5 (agent version 6.0.0-158) * Server Suite release 2022.1.10 (agent version 5.9.1-337)
Product
Cloud Suite and Privileged Access Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.delinea.com trust.delinea.com
Feb 14, 2026In the Linux kernel, the following vulnerability has been resolved: btrfs: send: check for inline extents in range_is_hole_in_parent() Before accessing the diCVE-2026-23141 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: btrfs: send: check for inline extents in range_is_hole_in_parent() Before accessing the disk_bytenr field of a file extent item we need to check if we are dealing with an inline extent. This is because for inline extents their data starts at the offset of the disk_bytenr field. So accessing the disk_bytenr means we are accessing inline data or in case the inline data is less than 8 bytes we can actually cause an invalid memory access if this inline extent item is the first item in the leaf or access metadata from other items.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Feb 14, 2026UpMenu – Online ordering for restaurants: Stored Cross-Site ScriptingCVE-2026-1910 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UpMenu – Online ordering for restaurants plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lang' attribute of the 'upmenu-menu' shortcode in all versions up to, and including, 3.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UpMenu – Online ordering for restaurants
Affected
up to 3.1
What to do
Affects up to 3.1. Update UpMenu – Online ordering for restaurants to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2026MasterStudy LMS WordPress Plugin – for Online Courses and Education: Stored Cross-Site ScriptingCVE-2026-0559 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_lms_courses_grid_display' shortcode in all versions up to, and including, 3.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Affected
up to 3.7.11
What to do
Affects up to 3.7.11. Update MasterStudy LMS WordPress Plugin – for Online Courses and Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 13, 2026Vim is an open source, command line text editor.CVE-2026-26269 · Other software · vim · reported by GitHubMedium 5.4
Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf) with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command. The issue has been fixed as of Vim patch v9.1.2148.
Product
vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 12, 2026SurfOffline Professional 2.2.0.103 contains a structured exception handler (SEH) overflow vulnerability that allows attackers to crash the application by manipuCVE-2019-25330 · Other software · Bimesoft · reported by VulnCheckMedium 6.7
SurfOffline Professional 2.2.0.103 contains a structured exception handler (SEH) overflow vulnerability that allows attackers to crash the application by manipulating the project name input. Attackers can generate a malicious payload of 382 'A' characters followed by specific byte sequences to trigger a denial of service condition and overwrite SEH registers.
Product
SurfOffline Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web.archive.org exploit-db.com
Feb 11, 2026Outline is a service that allows for collaborative documentation.CVE-2026-25062 · Other software · outline · reported by GitHubMedium 5.5
Outline is a service that allows for collaborative documentation. Prior to 1.4.0, during the JSON import process, the value of attachments[].key from the imported JSON is passed directly to path.join(rootPath, node.key) and then read using fs.readFile without validation. By embedding path traversal sequences such as ../ or absolute paths, an attacker can read arbitrary files on the server and import them as attachments. This vulnerability is fixed in 1.4.0.
Product
outline
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 11, 2026Outline is a service that allows for collaborative documentation.CVE-2025-68663 · Other software · outline · reported by GitHubMedium 6.9
Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a vulnerability was found in Outline's WebSocket authentication mechanism that allows suspended users to maintain or establish real-time WebSocket connections and continue receiving sensitive operational updates after their account has been suspended. This vulnerability is fixed in 1.1.0.
Product
outline
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 11, 2026Outline is a service that allows for collaborative documentation.CVE-2025-64487 · Other software · outline · reported by GitHubHigh 7.6
Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a privilege escalation vulnerability exists in the Outline document management system due to inconsistent authorization checks between user and group membership management endpoints. This vulnerability is fixed in 1.1.0.
Product
outline
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 11, 2026Proctorio Chrome Extension is a browser extension used for online proctoring.CVE-2026-2345 · Other software · Proctorio · reported by 7004884b-51e2-48e8-b4a2-5ca29e80453eLow 3.6
Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal messaging bridge processes messages based solely on the presence of a fromWebsite property without verifying the event.origin attribute.
Product
Secure Exam Proctor Extension
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hckrt.com
Feb 10, 2026An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.CVE-2026-25610 · Other software · MongoDB Inc · reported by cna@mongodb.comHigh 7.1
An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.
Product
MongoDB Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.mongodb.org
Feb 9, 2026unity-cli is a command line utility for the Unity Game Engine.CVE-2026-25918 · Other software · RageAgainstThePixel · reported by GitHubMedium 5.9
unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems. This vulnerability is fixed in 1.8.2.
Product
unity-cli
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 6, 2026Vim is an open source, command line text editor.CVE-2026-25749 · Other software · vim · reported by GitHubMedium 6.6
Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.
Product
vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 6, 2026Infor SyteLine ERP uses hard-coded static cryptographic keys to encrypt stored credentials, including user passwords, database connection strings, and API keys.CVE-2026-2103 · Other software · Infor · reported by cves@blacklanternsecurity.comHigh 7.1
Infor SyteLine ERP uses hard-coded static cryptographic keys to encrypt stored credentials, including user passwords, database connection strings, and API keys. The encryption keys are identical across all installations. An attacker with access to the application binary and database can decrypt all stored credentials.
Product
SyteLine ERP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.blacklanternsecurity.com
Feb 5, 2026Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines): Insecure Direct Object ReferenceCVE-2026-1228 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.3 via the tlgb_shortcode() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to disclose private timeline content via the id attribute supplied to the 'timeline_block' shortcode.
Product
Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines)
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2026Collabora Online is a collaborative online office suite based on LibreOffice technology.CVE-2026-23623 · Other software · CollaboraOnline · reported by GitHubMedium 5.3
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to Collabora Online Development Edition version 25.04.08.2 and prior to Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5, a user with view-only rights and no download privileges can obtain a local copy of a shared file. Although there are no corresponding buttons in the interface, pressing Ctrl+Shift+S initiates the file download process. This allows the user to bypass the access restrictions and leads to unauthorized data retrieval. This issue has been patched in Collabora Online Development Edition version 25.04.08.2 and Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5.
Product
online
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 4, 2026melange allows users to build apk packages using declarative pipelines.CVE-2026-25145 · Other software · chainguard-dev · reported by GitHubMedium 5.5
melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The LicensingInfos function in pkg/config/config.go reads license files specified in copyright[].license-path without validating that paths remain within the workspace directory, allowing path traversal via ../ sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts. This issue has been patched in version 0.40.3.
Product
melange
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 4, 2026melange allows users to build apk packages using declarative pipelines.CVE-2026-25143 · Other software · chainguard-dev · reported by GitHubHigh 7.8
melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml embeds input-derived values (series paths, patch filenames, and numeric parameters) into shell scripts without proper quoting or validation, allowing shell metacharacters to break out of their intended context. The vulnerability affects the built-in patch pipeline which can be invoked through melange build and melange license-check operations. An attacker who can control patch-related inputs (e.g., through pull request-driven CI, build-as-a-service, or by influencing melange configurations) can inject shell metacharacters such as backticks, command substitutions $(…), semicolons, pipes, or redirections to execute arbitrary commands with the privileges of the melange build process. This issue has been patched in version 0.40.3.
Product
melange
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 4, 2026melange allows users to build apk packages using declarative pipelines.CVE-2026-24844 · Other software · chainguard-dev · reported by GitHubHigh 7.9
melange allows users to build apk packages using declarative pipelines. From version 0.3.0 to before 0.40.3, an attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses ${{vars.*}} or ${{inputs.*}} substitutions in working-directory. The field is embedded into shell scripts without proper quote escaping. This issue has been patched in version 0.40.3.
Product
melange
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 4, 2026melange allows users to build apk packages using declarative pipelines.CVE-2026-24843 · Other software · chainguard-dev · reported by GitHubHigh 8.2
melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing path traversal via ../ sequences. This issue has been patched in version 0.40.3.
Product
melange
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 4, 2026In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify() On error handling paCVE-2026-23079 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify() On error handling paths, lineinfo_changed_notify() doesn't free the allocated resources which results leaks. Fix it.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Feb 4, 2026In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Coalesce only linear skb vsock/virtio common tries to coalesce buffers in rxCVE-2026-23057 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Coalesce only linear skb vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb (with a spare tail room) is followed by a small skb (length limited by GOOD_COPY_LEN = 128), an attempt is made to join them. Since the introduction of MSG_ZEROCOPY support, assumption that a small skb will always be linear is incorrect. In the zerocopy case, data is lost and the linear skb is appended with uninitialized kernel memory. Of all 3 supported virtio-based transports, only loopback-transport is affected. G2H virtio-transport rx queue operates on explicitly linear skbs; see virtio_vsock_alloc_linear_skb() in virtio_vsock_rx_fill(). H2G vhost-transport may allocate non-linear skbs, but only for sizes that are not considered for coalescence; see PAGE_ALLOC_COSTLY_ORDER in virtio_vsock_alloc_skb(). Ensure only linear skbs are coalesced. Note that skb_tailroom(last_skb) > 0 guarantees last_skb is linear.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Feb 4, 2026SEO Flow by LupsOnline: Unauthorized modification of dataCVE-2025-15285 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentication() and checkCategoryAuthentication() functions in all versions up to, and including, 2.2.1. These authorization functions only implement basic API key authentication but fail to implement WordPress capability checks. This makes it possible for unauthenticated attackers to create, modify, and delete blog posts and categories.
Product
SEO Flow by LupsOnline
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update SEO Flow by LupsOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 3, 2026Online Inventory Manager 3.2 contains a stored cross-site scripting vulnerability in the group description field of the admin edit groups section.CVE-2019-25265 · Other software · Bigprof · reported by VulnCheckMedium 5.1
Online Inventory Manager 3.2 contains a stored cross-site scripting vulnerability in the group description field of the admin edit groups section. Attackers can inject malicious JavaScript through the description field that will execute when the groups page is viewed, allowing potential cookie theft and client-side script execution.
Product
Online Inventory Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bigprof.com bigprof.com
Feb 3, 2026Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature.CVE-2026-1592 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 6.3
Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, allowing arbitrary JavaScript execution when the layer is referenced. This issue affects pdfonline.foxit.com: before 2026‑02‑03.
Product
pdfonline.foxit.com
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxit.com
Feb 3, 2026Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature.CVE-2026-1591 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 6.3
Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is displayed. This issue affects pdfonline.foxit.com: before 2026‑02‑03.
Product
pdfonline.foxit.com
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxit.com
Feb 3, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object References (IDOR)CVE-2026-1375 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_action()`, `bulk_delete_course()`, and `update_course_status()` functions. This makes it possible for authenticated attackers, with Tutor Instructor-level access and above, to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 3.9.5
What to do
Affects up to 3.9.5. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 3, 2026Tutor LMS – eLearning and online course solution: Sensitive Information ExposureCVE-2026-1371 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.5. This is due to missing authorization checks in the `ajax_coupon_details()` function, which only validates nonces but does not verify user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive coupon information including coupon codes, discount amounts, usage statistics, and course/bundle applications.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 3.9.5
What to do
Affects up to 3.9.5. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 2, 2026Brocade Fabric OS before 9.2.1 has a vulnerability that could allow a local authenticated attacker to reveal command line passwords using commands that may expoCVE-2025-58379 · Other software · Brocade · reported by sirt@brocade.comMedium 6
Brocade Fabric OS before 9.2.1 has a vulnerability that could allow a local authenticated attacker to reveal command line passwords using commands that may expose higher privilege sensitive information by a lower privileged user.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com
Feb 2, 2026Rizin is a UNIX-like reverse engineering framework and command-line toolset.CVE-2026-22780 · Other software · rizinorg · reported by GitHubMedium 4.4
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Prior to 0.8.2, a heap overflow can be exploited when a malicious mach0 file, having bogus entries for the dyld chained segments, is parsed by rizin. This vulnerability is fixed in 0.8.2.
Product
rizin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 2, 2026An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and setting one is not enforceCVE-2022-50981 · Other software · Innomic · reported by info@cert.vde.comCritical 9.8
An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and setting one is not enforced.
Product
VibroLine VLX1 HD 5.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record innomic.com innomic.com
Feb 2, 2026A unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via CAN.CVE-2022-50980 · Other software · Innomic · reported by info@cert.vde.comMedium 6.5
A unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via CAN.
Product
VibroLine VLX1 HD 5.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record innomic.com innomic.com
Feb 2, 2026An unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (RS485).CVE-2022-50979 · Other software · Innomic · reported by info@cert.vde.comMedium 6.5
An unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (RS485).
Product
VibroLine VLX1 HD 5.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record innomic.com innomic.com
Feb 2, 2026An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (TCP).CVE-2022-50978 · Other software · Innomic · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (TCP).
Product
VibroLine VLX1 HD 5.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record innomic.com innomic.com
Feb 2, 2026An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via HTTP.CVE-2022-50977 · Other software · Innomic · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via HTTP.
Product
VibroLine VLX1 HD 5.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record innomic.com innomic.com
Feb 2, 2026A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.CVE-2022-50976 · Other software · Innomic · reported by info@cert.vde.comHigh 7.7
A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.
Product
VibroLine Configurator 5.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record innomic.com innomic.com
Feb 2, 2026An unauthenticated remote attacker is able to use an existing session id of a logged in user and gain full access to the device if configuration via ethernet isCVE-2022-50975 · Other software · Innomic · reported by info@cert.vde.comHigh 8.8
An unauthenticated remote attacker is able to use an existing session id of a logged in user and gain full access to the device if configuration via ethernet is enabled.
Product
VibroLine VLX1 HD 5.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record innomic.com innomic.com
Feb 1, 2026Avast SecureLine 5.5.522.0 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges.CVE-2020-37037 · Other software · Avast · reported by VulnCheckHigh 8.5
Avast SecureLine 5.5.522.0 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious code that would execute with LocalSystem account permissions during service startup.
Product
AVAST SecureLine
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record avast.com exploit-db.com
Feb 1, 2026Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules.CVE-2021-47909 · Other software · Techraft · reported by VulnCheckHigh 8.6
Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged vendor or admin roles can exploit the 'id' parameter to execute malicious SQL commands and compromise the database management system.
Product
Digital Multivendor Marketplace Online Store
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ultimate.multecart.com techraft.in

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.