Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25,752 results · page 25 of 516
Sep 3, 2026Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task hanCVE-2026-78000 · Websites & servers · reported by security@joomla.orgMedium 5.3
Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1CVE-2026-77999 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check (`_validateIPN()`) accepted `UNVERIFIED` and any non-`INVALID` response as valid, made its verification request with `CURLOPT_SSL_VERIFYPEER` disabled, and stored its verdict in a field nothing downstream ever checked — so processing continued regardless of the outcome. Separately, the paid-amount comparison only ran when `mc_gross` was a positive number; omitting the field from the POST body (`floatval(null) == 0`) skipped the check entirely. Combined with a merchant-configured `receiver_email` and a sequential, enumerable order id read from the `custom` field, an anonymous POST was enough to move a pending order straight to `CONFIRMED` with no payment, or force another customer's pending order to `FAILED`. `paypalv2.php` performed no amount check under any circumstances.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of CVE-2026-84674 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
- Product
- Jenkins XebiaLabs XL Deploy Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences eCVE-2026-84805 · Other software · kimai · reported by VulnCheckMedium 5.3
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permission check, so an authenticated regular user can use the API to modify their own admin-only work-contract data. The issue is fixed in 2.63.0 by applying the same permission check to the API endpoint.
- Product
- kimai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 2, 2026Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisiCVE-2026-84799 · Other software · craftcms · reported by VulnCheckMedium 5.3
Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of any content author or uploader including administrators.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 2, 2026Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions.CVE-2026-84780 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions.
- Affected
- up to 10.1.08
- What to do
- Affects up to 10.1.08. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 1, 2026A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4.CVE-2026-84438 · Other software · reported by VulDBLow 2
A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4.CVE-2026-84437 · Other software · reported by VulDBLow 2
A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address_1 results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-contrCVE-2026-45221 · Other software · EASYBYTE Software · reported by VulnCheckHigh 8.5
Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path absent from default installations. On Windows, the missing directory resides in a location writable by any authenticated local user, enabling attackers to create the directory and place malicious files that execute at the privilege level of the user or service account that launches Konga, facilitating privilege escalation.
- Product
- Konga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublic.easybyte.iteasybyte.it
Sep 1, 2026Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 mighCVE-2026-83551 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.5
Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.
- Product
- sagemaker-python-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Aug 31, 2026A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0.CVE-2026-82914 · Other software · kishan0725 · reported by VulDBMedium 5.5
A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Hospital-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorduvxbywu62qm.feishu.cnvuldb.com
Aug 31, 2026A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15.CVE-2026-82909 · Other software · QuantumNous · reported by VulDBLow 2.1
A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.0.0-rc.17 can resolve this issue. This patch is called 0d5995eb63f8801d32eb32fbe74b75b68752bfa9. The affected component should be upgraded.
- Product
- new-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.CVE-2026-81778 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026TechStore 1.0 is vulnerable to Cross Site Scripting (XSS).CVE-2025-63607 · Other software · reported by MITREMedium 6.1
TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Aug 31, 2026A weakness has been identified in caoqianming django-vue-admin 1.0.CVE-2026-82835 · Other software · caoqianming · reported by VulDBLow 2.1
A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of the argument file_id can lead to improper access controls. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- django-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Aug 31, 2026A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome.CVE-2026-82810 · Other software · extension.vn · reported by VulDBLow 1.9
A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information disclosure. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
- Product
- 2FA Authenticator Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A vulnerability has been found in armink struct2json 1.0.CVE-2026-82803 · Computers, phones & browsers · armink · reported by VulDBMedium 5.5
A vulnerability has been found in armink struct2json 1.0. This affects the function S2J_STRUCT_GET_string_ELEMENT in the library struct2json/inc/s2jdef.h of the component JSON Deserialization. The manipulation of the argument valuestring leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- struct2json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A flaw has been found in NASA earthdata-search 1.0.0.CVE-2026-82802 · Other software · NASA · reported by VulDBMedium 5.5
A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLambda of the file serverless/src/openSearchGranuleSearch/handler.js of the component granules Endpoint. Executing a manipulation of the argument openSearchOsdd can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- earthdata-search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A vulnerability was detected in NASA earthdata-search 1.0.0.CVE-2026-82801 · Other software · NASA · reported by VulDBMedium 5.5
A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/handler.js of the component scale Endpoint. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- earthdata-search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04.CVE-2026-82688 · Network & remote access · D-Link · reported by VulDBHigh 8.5
A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-bin/virtual_vol.cgi of the component Virtual Volume Handler. The manipulation of the argument f_sharename/f_target/f_name leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
- Product
- DNS-340L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A weakness has been identified in D-Link DSM-G600 1.01.CVE-2026-82680 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A weakness has been identified in D-Link DSM-G600 1.01. This affects an unknown function of the file /load_file.cgi of the component Multipart Handler. Executing a manipulation can lead to out-of-bounds write. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- DSM-G600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A vulnerability was determined in valkey-io valkey 9.1.0.CVE-2026-82677 · Other software · valkey-io · reported by VulDBLow 1.9
A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.
- Product
- valkey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A vulnerability has been found in yaojingang GEOFlow up to 2.1.0.CVE-2026-82667 · Other software · yaojingang · reported by VulDBLow 2
A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/GenericHttpEndpointResolver.php. Such manipulation of the argument endpoint_url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.1 is recommended to address this issue. The name of the patch is 67abfd864a15d169a78429f3290c91cb3b93e849. It is advisable to upgrade the affected component.
- Product
- GEOFlow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A flaw has been found in yaojingang GEOFlow up to 2.1.0.CVE-2026-82666 · Other software · yaojingang · reported by VulDBLow 2
A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 2.1.1 is capable of addressing this issue. Patch name: 67abfd864a15d169a78429f3290c91cb3b93e849. Upgrading the affected component is advised.
- Product
- GEOFlow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A vulnerability was detected in yaojingang GEOFlow up to 2.1.0.CVE-2026-82665 · Other software · yaojingang · reported by VulDBLow 2
A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the file app/Http/Controllers/Admin/ImageLibraryController.php of the component Image Library Cleanup. The manipulation of the argument file_path results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 2.1.1 is able to resolve this issue. The patch is identified as 67abfd864a15d169a78429f3290c91cb3b93e849. It is recommended to upgrade the affected component.
- Product
- GEOFlow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0.CVE-2026-82664 · Other software · yaojingang · reported by VulDBLow 2.1
A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController.php of the component JSON-LD Theme Handler. The manipulation of the argument Search leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.1.1 is able to mitigate this issue. The identifier of the patch is 67abfd864a15d169a78429f3290c91cb3b93e849. Upgrading the affected component is recommended.
- Product
- GEOFlow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A security flaw has been discovered in valkey-io valkey 9.1.0.CVE-2026-82631 · Other software · valkey-io · reported by VulDBLow 1.2
A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.
- Product
- valkey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703.CVE-2026-82616 · Other software · TOTOLINK · reported by VulDBHigh 8.6
A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.
- Product
- NR1800X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703.CVE-2026-82597 · Other software · TOTOLINK · reported by VulDBLow 2.1
A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
- Product
- NR1800X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints thaCVE-2026-82641 · Other software · Keploy · reported by VulnCheckHigh 8.8
Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.
- Product
- Keploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026A vulnerability was identified in Beetel 450TC3 01.00.00_01.CVE-2026-82488 · Other software · Beetel · reported by VulDBLow 2
A vulnerability was identified in Beetel 450TC3 01.00.00_01. This vulnerability affects unknown code of the component User Management. The manipulation of the argument Username leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 450TC3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026A vulnerability was determined in Beetel 450TC3 01.00.00_01.CVE-2026-82487 · Other software · Beetel · reported by VulDBLow 2.1
A vulnerability was determined in Beetel 450TC3 01.00.00_01. This affects an unknown part. Executing a manipulation can lead to weak password recovery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 450TC3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2026A vulnerability has been found in macrozheng mall up to 1.0.3.CVE-2026-82423 · Other software · macrozheng · reported by VulDBLow 2.1
A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.
- Product
- mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2026Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and theCVE-2026-82447 · Other software · Skyvern-AI · reported by VulnCheckHigh 8.7
Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.
- Product
- skyvern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2026A security vulnerability has been detected in macrozheng mall up to 1.0.3.CVE-2026-82364 · Other software · macrozheng · reported by VulDBLow 2.3
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /order/submit of the component Order Submission. The manipulation leads to race condition. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The vendor deleted the GitHub issue for this vulnerability without and explanation.
- Product
- mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection.CVE-2026-3627 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.1
IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
- Product
- Concert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow witCVE-2026-19295 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization.CVE-2026-19294 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.4
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A puCVE-2026-19286 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collisioCVE-2026-18904 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.2
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.CVE-2026-18899 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.CVE-2026-18891 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.2
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.CVE-2026-18729 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF).CVE-2026-18545 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate valCVE-2025-64649 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation.
- Product
- Concert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to CVE-2025-36290 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.
- Product
- Integrated Analytics System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiCVE-2025-36271 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- Integrated Analytics System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessiCVE-2026-82272 · Other software · immich-app · reported by VulnCheckHigh 7.1
Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links, bypassing the locked visibility protection.
- Product
- immich
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitCVE-2026-77939 · Other software · flextype · reported by VulnCheckHigh 7.1
Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage exposed application objects including filesystem() and serializers() within the evaluation scope to read arbitrary server files and achieve conditional remote code execution if a PHP file can be placed on disk through a secondary vector.
- Product
- flextype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 28, 2026Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.CVE-2026-81757 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.
- Affected
- up to 1.0.276
- What to do
- Affects up to 1.0.276. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.