Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
391,883 results · page 248 of 7838
Oct 13, 2026SFTPGo is an open source, event-driven file transfer solution.CVE-2026-77375 · Other software · drakkan · reported by GitHubMedium 6.5
SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.
- Product
- sftpgo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026MediaAgent contained a heap-based buffer overflow issue affecting service availability.CVE-2026-77100 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333High 8.7
MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.
- Product
- Commvault Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.com
Oct 13, 2026CVFS contained an input validation issue affecting command execution.CVE-2026-77099 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333Critical 9.3
CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
- Product
- Commvault Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.com
Oct 13, 2026CVFS contained a missing authentication condition affecting command execution.CVE-2026-77096 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333High 7.7
CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
- Product
- Commvault Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.com
Oct 13, 2026CvFWD contained a null pointer dereference affecting service availability.CVE-2026-77095 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333High 7.1
CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
- Product
- Commvault Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.com
Oct 13, 2026CvFWD contained an out-of-bounds write affecting service availability.CVE-2026-77094 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333High 7.1
CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
- Product
- Commvault Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.com
Oct 13, 2026CvFWD contained an integer overflow affecting service availability.CVE-2026-77093 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333High 7.1
CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale
- Product
- Commvault Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.com
Oct 13, 2026CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure.CVE-2026-77090 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333High 8.7
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.
- Product
- Commvault Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.com
Oct 13, 2026The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transporCVE-2026-65200 · Other software · Huawei · reported by 44488dab-36db-4358-99f9-bc116477f914Low 3.5
The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An undersized response wraps the unsigned length difference to a very large value, and the parser then reads far past the response buffer. The affected code sits in the base (non-vendor) PLDM control class and the Huawei NCSI driver, so it is reachable for any PLDM endpoint or Huawei NIC on the internal management bus, unlike the vendor-specific wangxun parser tracked separately.
- Product
- openBMC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers.CVE-2026-65199 · Other software · Huawei · reported by 44488dab-36db-4358-99f9-bc116477f914Medium 5.4
openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete nine-privilege set for a `special_users` group that includes the `SNMPv1_v2c` pseudo-user.
- Product
- openBMC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy.CVE-2026-65198 · Other software · Huawei · reported by 44488dab-36db-4358-99f9-bc116477f914High 8.6
Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.
- Product
- openUBMC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`.CVE-2026-65197 · Other software · H3C · reported by 44488dab-36db-4358-99f9-bc116477f914Low 3.1
H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after validating only that the multipart filename ends in `.pem`. An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key. This was observed on H3C HDM Family-A G5 HDM 6.14.01. H3C HDM Family-A G3/G5 builds carrying the Redfish/DRE update tree appear to be affected. HDM2 uses a different update path and is not covered by this finding.
- Product
- HDM Family-A G5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026MCP Context Forge provides an MCP Admin UI for managing gateway resources.CVE-2026-53711 · Other software · IBM · reported by GitHubMedium 5.1
MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the MCP Admin UI renders it. An authenticated attacker can save markup containing script-capable event handlers, and the code executes when another user views the saved prompt. The stored cross-site scripting can alter the interface, present phishing content, observe keystrokes available to the page, and act with the viewer's browser session. This issue is fixed in version 0.3.1.
- Product
- mcp-context-forge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026MCP Context Forge is an MCP gateway and administrative platform.CVE-2026-53709 · Other software · IBM · reported by GitHubCritical 9.8
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2.
- Product
- mcp-context-forge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.CVE-2026-53420 · Other software · Zoom Communications · reported by security@zoom.usHigh 8
Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.
- Product
- Zoom Workplace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalCVE-2026-53418 · Other software · Zoom Communications · reported by security@zoom.usHigh 8.1
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Workplace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier when running compressed Basic MSI setup with Prerequisites frCVE-2026-4869 · Other software · Flexera · reported by PSIRT-CNA@flexerasoftware.comMedium 5.4
A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier when running compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches a compressed Setup.exe with Prerequisites from an unsecured location, the Prerequisite installers also might load from an unsecured location, potentially leading to privilege escalation.
- Product
- InstallShield
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.revenera.com
Oct 13, 2026HyperScale contained a path traversal issue affecting information disclosure.CVE-2026-18228 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333High 7.1
HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.
- Product
- Commvault Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.com
Oct 13, 2026A denial-of-service security issue exists in the affected product and version.CVE-2026-12656 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to its normal state.
- Product
- 1732E ArmorBlock® I/O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Oct 13, 2026A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials.CVE-2026-12655 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.8
A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration.
- Product
- 1732E ArmorBlock® I/O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Oct 13, 2026An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacCVE-2026-11732 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Medium 6.3
An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.
- Product
- CAX30
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comnetgear.com
Oct 13, 2026An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s CVE-2026-11731 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Medium 6.3
An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.
- Product
- RAX30
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comnetgear.com
Oct 13, 2026Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credeCVE-2026-11730 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Low 2.1
Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.
- Product
- EX3700
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comnetgear.com
Oct 13, 2026A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.CVE-2026-109523 · Other software · girishsaraf · reported by VulDBMedium 5.5
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Appointment-Booking-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.CVE-2026-109522 · Other software · girishsaraf · reported by VulDBMedium 5.5
A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Appointment-Booking-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.CVE-2026-109521 · Other software · girishsaraf · reported by VulDBMedium 5.5
A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Appointment-Booking-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via netwoCVE-2026-108185 · Other software · Zoom Communications · reported by security@zoom.usHigh 7.4
Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.CVE-2026-108184 · Other software · Zoom Communications · reported by security@zoom.usHigh 7.4
Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network CVE-2026-107918 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Medium 4.3
Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router.This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices.
- Product
- R7300DST
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comnetgear.com
Oct 13, 2026Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local networCVE-2026-107917 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Medium 4.3
Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router. This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices.
- Product
- R7300DST
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comnetgear.com
Oct 13, 2026Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed throuCVE-2026-107460 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's resolved IP addresses and then opens a separate connection that can resolve the hostname again. An attacker who controls DNS responses for the URL hostname may cause the connection to reach a restricted address after validation. CVE-2026-49328 covers SSRF in releases before 2.0.2-incubating; this issue is a DNS rebinding bypass of the protection in 2.0.2-incubating. Apache Fesod (Incubating) 2.1.0-incubating addresses the reported default-fetch scenario by disabling remote URL image fetching by default and requiring an explicit exact-host allowlist when the feature is enabled. Users should upgrade to 2.1.0-incubating. Applications enabling remote URL image fetching should allowlist only hostnames whose DNS and HTTP services are trusted.
- Product
- Apache Fesod (Incubating)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Quasar Framework is a framework for building high-performance Vue.js user interfaces.CVE-2026-106108 · Other software · quasarframework · reported by GitHubMedium 5.7
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages() could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent traversal or an existing symlink below the distribution directory could create new HTML files or directories outside the output tree with the build user's permissions. Application configuration and SSG page definitions are trusted by default, so exploitation requires a build process that derives them from external or otherwise less-trusted content; existing files remain protected by the renderer's no-overwrite behavior. This issue is fixed in version 3.3.0.
- Product
- quasar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Dragonfly is an in-memory data store built for modern application workloads.CVE-2026-104192 · Other software · dragonflydb · reported by GitHubCritical 9.6
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.
- Product
- dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026SFTPGo is an open source, event-driven file transfer solution.CVE-2026-103028 · Other software · drakkan · reported by GitHubMedium 4.3
SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the destination. The user can then read the denied file contents. Recursive directory copies can reproduce restricted contents under an allowed path, and the hide policy is bypassed because files that appear missing to stat and directory listings can still be copied. Home-directory boundaries, virtual-folder layout, per-directory permissions, access to other accounts, and administrative authorization remain enforced. This issue is fixed in 2.7.6.
- Product
- sftpgo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Gotify server is a simple server for sending and receiving messages in real-time per WebSocket.CVE-2026-102603 · Other software · gotify · reported by GitHubMedium 5.3
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.
- Product
- server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ammonia is a Rust library for repairing and securing untrusted HTML.CVE-2026-102342 · Other software · rust-ammonia · reported by GitHubMedium 5.4
ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.
- Product
- ammonia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begCVE-2026-102250 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.6
CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.
- Product
- Sage RTU 1410
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Oct 13, 2026A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to makeCVE-2024-34319 · Other software · reported by MITREMedium 6.5
A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprophoenix.comsedriclouissaint.com
Oct 13, 2026IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cCVE-2026-95680 · Other software · IBM · reported by psirt@us.ibm.comHigh 8
IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.
- Product
- WebSphere Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handlCVE-2026-93907 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.
- Product
- WebSphere Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary filesCVE-2026-93347 · Other software · Wazuh · reported by VulnCheckMedium 6.9
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read client.keys, ossec.conf with the cluster key, and other wazuh-readable files.
- Product
- wazuh-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending cCVE-2026-93346 · Other software · Wazuh · reported by VulnCheckMedium 6.9
Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent requests. Attackers can fire concurrent login bursts to the authenticate and run_as endpoints, each passing the block check before failures are counted, enabling unlimited password guessing.
- Product
- wazuh-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults.CVE-2026-77362 · Other software · The-40-Thieves · reported by GitHubMedium 4.3
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check. An authenticated caller can consequently infer or read data from notes outside the caller's read ACL. Version 1.3.1 fixes the vulnerability by filtering path-attributable fields and applying the read whitelist to list_templates.
- Product
- obsidian-tc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults.CVE-2026-77361 · Other software · The-40-Thieves · reported by GitHubMedium 4.7
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allowed glob that resolves into a denied folder can therefore bypass the read ACL and expose files in the denied folder. Exploitation requires an out-of-band-planted symlink and does not permit an escape from the vault root. Version 1.3.1 fixes the vulnerability by applying ACL checks to the resolved vault-relative path.
- Product
- obsidian-tc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authdCVE-2026-74047 · Other software · Wazuh · reported by VulnCheckHigh 7.1
Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth component configuration for pseudo-agent ID 000 to obtain the secret and enroll rogue agents against the manager.
- Product
- wazuh-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR.CVE-2026-74045 · Other software · Wazuh · reported by VulnCheckHigh 7.1
Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.
- Product
- wazuh-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious clusCVE-2026-74043 · Other software · Wazuh · reported by VulnCheckHigh 8.5
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.
- Product
- wazuh-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command CVE-2026-74041 · Other software · Wazuh · reported by VulnCheckHigh 8.6
Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.
- Product
- wazuh-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker tCVE-2026-74040 · Other software · Wazuh · reported by VulnCheckCritical 9.4
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.
- Product
- wazuh-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist.CVE-2026-74037 · Other software · Wazuh · reported by VulnCheckHigh 8.6
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.
- Product
- wazuh-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.