Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,830 results · page 26 of 137
Sep 8, 2026Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network.CVE-2026-68834 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-68832 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Integer underflow (wrap or wraparound) in Windows GDI+ allows an authorized attacker to elevate privileges over a network.CVE-2026-68827 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Integer underflow (wrap or wraparound) in Windows GDI+ allows an authorized attacker to elevate privileges over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-68825 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-67381 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SQL Server 2017 (CU 31)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a neCVE-2026-67370 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SQL Server 2017 (CU 31)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-67368 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SQL Server 2017 (CU 31)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a neCVE-2026-66820 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SQL Server 2017 (CU 31)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a neCVE-2026-66819 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SQL Server 2017 (CU 31)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-66818 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SQL Server 2017 (CU 31)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-66814 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SQL Server 2017 (CU 31)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privCVE-2026-65669 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.
- Product
- SQL Server Management Studio 22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.CVE-2026-62895 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Arc SQL Server Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Heap-based buffer overflow in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.CVE-2026-62810 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.CVE-2026-62697 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-62694 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally.CVE-2026-58611 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally.
- Product
- Xbox Gaming Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to elevate privileges locally.CVE-2026-58600 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to elevate privileges locally.
- Product
- HEVC Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.CVE-2026-56198 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Windows Server allows an authorized attacker to elevate privileges locally.CVE-2026-56177 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Server allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.CVE-2026-56172 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by sCVE-2026-82062 · Other software · MongoDB · reported by cna@mongodb.comHigh 7
A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writes to arbitrary internal storage tables. The authorization check for these operations validates only the operation's namespace, not the actual storage target, enabling writes to unrelated internal metadata or other collections' data.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026AshLua exposes Ash read actions to Lua scripts run through an eval action.CVE-2026-78216 · Other software · ash-project · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbMedium 6
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization. The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible. This issue affects ash_lua: from 0.1.0 before 0.2.2.
- Product
- ash_lua
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Sep 7, 2026Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality.CVE-2026-86419 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 7
Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In feed processing, redirects were followed without validating the redirect scheme or destination. The original request headers were reused across redirect hops, meaning authentication headers or API credentials configured for a feed could be forwarded to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results to prevent re-resolution after validation. The TAXII discovery endpoint had a related incomplete SSRF defense. It used gethostbyname() and compared the result against only a few literal addresses. This missed cases including IPv6 loopback (::1), numeric host encodings such as 0x7f000001, and potentially multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator. Together, these commits harden MISP's outbound URL handling against alternate-address representation
- Product
- MISP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the correCVE-2026-79678 · Other software · Red Hat · reported by Red HatHigh 8.1
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 7, 2026In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path CVE-2026-84173 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.3
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with access restricted by such a rule can submit a CompleteStateRequest or UpdateStateRequest with an empty field mask. The request may then be incorrectly authorized as matching the scoped rule, allowing the workload to read the complete cluster state or replace state outside its authorized subtree. This may result in unauthorized disclosure or modification of other workloads and cluster configuration. Only a rule consisting solely of * is intended to authorize an empty mask. Mitigation: Until an update containing the fix is installed, avoid multi-segment Control Interface allow-rule filter masks that begin with a wildcard, such as *.workloads.some_workload. Replace them with explicit paths such as desiredState.workloads.some_workload, where applicable. A filter mask consisting solely of * has different, intentionally unrestricted semantics and should only be used when full-state access is intended.
- Product
- Eclipse Ankaios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.CVE-2026-86142 · Other software · xmlsoft · reported by MITREMedium 6.9
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
- Product
- libxml2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output deCVE-2026-85694 · Other software · lavague-ai · reported by VulnCheckCritical 9.2
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute arbitrary code on the operator's host without review.
- Product
- LaVague
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belongingCVE-2026-85693 · Other software · mckaywrigley · reported by VulnCheckHigh 7.1
Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and fails to validate file ownership, enabling attackers to retrieve indexed content chunks from victim files through crafted POST requests.
- Product
- chatbot-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.CVE-2026-83711 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
- Product
- Entra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.CVE-2026-80098 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Copilot Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.CVE-2026-70352 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure AI Language Authoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.CVE-2026-70178 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.5
Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.CVE-2026-65818 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.5
Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Power Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.CVE-2026-62916 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.1
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Entra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retrieval functionality.CVE-2026-85242 · Other software · Lookyloo · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 6.9
PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retrieval functionality. When only_global_lookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However, redirects followed by aiohttp were not subjected to the same validation. An attacker able to influence the content of a page processed by PlaywrightCapture could specify a publicly reachable favicon URL that responds with an HTTP redirect to a local or otherwise restricted address, such as 127.0.0.1, localhost, or an internal network service. Because aiohttp automatically followed the redirect, the resulting request could bypass the application's local-address restrictions and cause the PlaywrightCapture host to issue HTTP requests to resources that should not be externally reachable. Depending on the services reachable from the PlaywrightCapture host and how retrieved favicon data is subsequently exposed or processed, this could be used to probe internal HTTP services or potentially obtain information from otherwise inaccessible endpoints. The patch introduces an aiohttp request middl
- Product
- PlaywrightCapture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources oCVE-2026-75036 · Other software · SUSE · reported by meissner@suse.deMedium 5.3
A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a `GitRepo` resource can cause the Fleet controller to: - Disclose cluster metadata available to the templating context. - Reveal information about hosts reachable from the controller's network position. Because the disclosure channel is name resolution, it may remain effective in environments where outbound traffic is otherwise restricted. The disclosed information is limited to values exposed to the Fleet templating context and to name resolution results. Integrity and availability of managed clusters are not affected. This issue affects Fleet: from 0.12.0 before 0.12.19, from 0.13.0 before 0.13.15, from 0.14.0 before 0.14.10, from 0.15.0 before 0.15.6, and from 0.16.0 before 0.16.1.
- Product
- Fleet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the CVE-2026-9854 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 8.5
A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.
- Product
- MicroSCADA SYS600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Sep 3, 2026SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevateCVE-2026-84830 · Other software · SEPPmail AG · reported by vulnerability@ncsc.chHigh 8.6
SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges.
- Product
- Secure Email Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloads.seppmail.com
Sep 2, 2026PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer.CVE-2026-53706 · Other software · vbpf · reported by GitHubHigh 8.8
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the prevail eBPF verifier accepts ALU32 ADD and SUB instructions that operate on pointer-typed registers without checking the is64 flag. Because ALU32 arithmetic zero-extends the 32-bit result, the upper half of any pointer is silently destroyed at runtime, yet prevail marks the program as verified safe. Any caller that can submit an eBPF program for verification — including unprivileged users on kernels that permit BPF program loading — can produce a program that passes verification but faults or misbehaves at runtime. This issue has been patched in version 0.2.4.
- Product
- prevail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer.CVE-2026-53671 · Other software · vbpf · reported by GitHubCritical 9.3
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a T_CTX-typed base register as a silent no-op: do_mem_store in src/crab/ebpf_transformer.cpp only models T_STACK stores, and the checker's T_CTX bounds arm never tests AccessType::write. An attacker can craft an eBPF program that overwrites a context field (e.g., ctx->data), reload that field typed as T_PACKET, and dereference an attacker-controlled address — and prevail will report the program as safe. This issue has been patched in version 0.2.4.
- Product
- prevail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer.CVE-2026-53670 · Other software · vbpf · reported by GitHubCritical 9.3
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset (two or more simultaneously possible pointer types). Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime. This issue has been patched in version 0.2.4.
- Product
- prevail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session.CVE-2026-79989 · Other software · craftcms · reported by 7004884b-51e2-48e8-b4a2-5ca29e80453eHigh 8.7
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026A local privilege escalation vulnerability in HPE Networking Fabric Composer could allow an authenticated privileged user on the underlying host to elevate theiCVE-2026-73740 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.4
A local privilege escalation vulnerability in HPE Networking Fabric Composer could allow an authenticated privileged user on the underlying host to elevate their user privileges to those of a higher role. A successful exploit allows the attacker to change the state of certain settings of the affected system.
- Product
- Fabric Composer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execCVE-2026-51974 · Other software · reported by MITREHigh 8.8
An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom vaCVE-2026-83557 · Other software · FasterXML · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 5.6
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultT
- Product
- jackson-databind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.CVE-2026-65643 · Websites & servers · reported by support@hackerone.comHigh 8.7
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2026Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp.CVE-2026-82470 · Other software · jeremyevans · reported by VulnCheckMedium 5.1
Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor.
- Product
- rodauth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2026Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh tokCVE-2026-82469 · Other software · jeremyevans · reported by VulnCheckMedium 5.1
Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinite account access with temporary token possession.
- Product
- rodauth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2026Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation.CVE-2026-82468 · Other software · jeremyevans · reported by VulnCheckMedium 4.9
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.
- Product
- rodauth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.