Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,128 results · page 26 of 83
Apr 1, 2026AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.CVE-2026-34515 · Other software · aio-libs · reported by GitHubMedium 6.6
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
- Product
- aiohttp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.CVE-2026-34514 · Other software · aio-libs · reported by GitHubLow 2.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
- Product
- aiohttp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.CVE-2026-34513 · Other software · aio-libs · reported by GitHubLow 2.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4.
- Product
- aiohttp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.CVE-2026-22815 · Other software · aio-libs · reported by GitHubMedium 6.9
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4.
- Product
- aiohttp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-34443 · Other software · freescout-help-desk · reported by GitHubMedium 6.9
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, checkIpByMask() in app/Misc/Helper.php checks whether the input IP contains a / character. Plain IP addresses never contain /, so the function always returns false without checking any CIDR ranges. The entire 10.0.0.0/8 and 172.16.0.0/12 private ranges are unprotected. This issue has been patched in version 1.8.211.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.CVE-2026-34442 · Other software · freescout-help-desk · reported by GitHubMedium 5.4
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (http://localhost:8080/system/status) allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. When the application constructs links and assets using the unvalidated Host header, user requests can be redirected to attacker-controlled domains and external resources may be loaded from malicious servers. This issue has been patched in version 1.8.211.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2026-34372 · Other software · sulu · reported by GitHubMedium 5.3
Sulu is an open-source PHP content management system based on the Symfony framework. From versions 1.0.0 to before 2.6.22, and 3.0.0 to before 3.0.5, a user which has permission for the Sulu Admin via at least one role could have access to the sub-entities of contacts via the admin API without even have permission for contacts. This issue has been patched in versions 2.6.22 and 3.0.5.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data.CVE-2026-24165 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.
- Product
- BioNeMo Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Mar 31, 2026NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data.CVE-2026-24164 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.8
NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.
- Product
- BioNeMo Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Mar 31, 2026Slippers is a UI component framework for Django.CVE-2026-34231 · Other software · mixxorz · reported by GitHubMedium 6.1
Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting (XSS) vulnerability exists in the {% attrs %} template tag of the slippers Django package. When a context variable containing untrusted data is passed to {% attrs %}, the value is interpolated into an HTML attribute string without escaping, allowing an attacker to break out of the attribute context and inject arbitrary HTML or JavaScript into the rendered page. This issue has been patched in version 0.6.3.
- Product
- slippers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026Sliver is a command and control framework that uses a custom Wireguard netstack.CVE-2026-34227 · Other software · BishopFox · reported by GitHubMedium 5.9
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data (e.g. SSH keys, ntds.dit) or destroying the entire compromised infrastructure, entirely through the operator's own browser. This issue has been patched in version 1.7.4.
- Product
- sliver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026LangChain is a framework for building agents and LLM-powered applications.CVE-2026-34070 · Other software · langchain-ai · reported by GitHubHigh 7.5
LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.
- Product
- langchain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Moby is an open source container framework.CVE-2026-34040 · Other software · moby · reported by GitHubHigh 8.8
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Moby is an open source container framework.CVE-2026-33997 · Other software · moby · reported by GitHubMedium 6.8
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026baserCMS is a website development framework.CVE-2026-32734 · Other software · baserproject · reported by GitHubHigh 7.1
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has DOM-based cross-site scripting in tag creation. This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Mar 30, 2026baserCMS is a website development framework.CVE-2026-30940 · Other software · baserproject · reported by GitHubHigh 7.2
baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme-file/theme_files/add.json) that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path parameter to create a PHP file in an arbitrary directory outside the theme directory, which may result in remote code execution (RCE). This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Mar 30, 2026baserCMS is a website development framework.CVE-2026-30880 · Other software · baserproject · reported by GitHubCritical 9.2
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Mar 30, 2026baserCMS is a website development framework.CVE-2026-30879 · Other software · baserproject · reported by GitHubMedium 6.9
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a cross-site scripting vulnerability in blog posts. This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Mar 30, 2026baserCMS is a website development framework.CVE-2026-30878 · Other software · baserproject · reported by GitHubMedium 5.3
baserCMS is a website development framework. Prior to version 5.2.3, a public mail submission API allows unauthenticated users to submit mail form entries even when the corresponding form is not accepting submissions. This bypasses administrative controls intended to stop form intake and enables spam or abuse via the API. This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Mar 30, 2026baserCMS is a website development framework.CVE-2026-30877 · Other software · baserproject · reported by GitHubCritical 9.1
baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS. This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Mar 30, 2026baserCMS is a website development framework.CVE-2026-27697 · Other software · baserproject · reported by GitHubMedium 6.9
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Mar 30, 2026baserCMS is a website development framework.CVE-2026-21861 · Other software · baserproject · reported by GitHubCritical 9.1
baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec() without sufficient validation or escaping. This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Mar 30, 2026baserCMS is a website development framework.CVE-2025-32957 · Other software · baserproject · reported by GitHubHigh 8.7
baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included. This issue has been patched in version 5.2.3.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Mar 27, 2026Netty is an asynchronous, event-driven network application framework.CVE-2026-33871 · Other software · netty · reported by GitHubHigh 8.7
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Mar 27, 2026Netty is an asynchronous, event-driven network application framework.CVE-2026-33870 · Other software · netty · reported by GitHubHigh 7.5
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework.CVE-2026-33730 · Other software · opensourcepos · reported by GitHubMedium 6.5
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows an authenticated low-privileged user to access the password change functionality of other users, including administrators, by manipulating the `employee_id` parameter. The application does not verify object ownership or enforce authorization checks. Version 3.4.2 adds object-level authorization checks to validate that the current user owns the employee_id being accessed.
- Product
- opensourcepos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Sharp is a content management framework built for Laravel as a package.CVE-2026-33687 · Other software · code16 · reported by GitHubHigh 8.8
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 contain a vulnerability in the file upload endpoint that allows authenticated users to bypass all file type restrictions. The upload endpoint within the `ApiFormUploadController` accepts a client-controlled `validation_rule` parameter. This parameter is directly passed into the Laravel validator without sufficient server-side enforcement. By intercepting the request and sending `validation_rule[]=file`, an attacker can completely bypass all MIME type and file extension restrictions. This issue has been addressed in version 9.20.0 by removing the client-controlled validation rules and strictly defining upload rules server-side. As a workaround, ensure that the storage disk used for Sharp uploads is strictly private. Under default configurations, an attacker cannot directly execute uploaded PHP files unless a public disk configuration is explicitly used.
- Product
- sharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Sharp is a content management framework built for Laravel as a package.CVE-2026-33686 · Other software · code16 · reported by GitHubHigh 8.8
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.
- Product
- sharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Streamlit is a data oriented application development framework for python.CVE-2026-33682 · Other software · streamlit · reported by GitHubMedium 4.7
Streamlit is a data oriented application development framework for python. Streamlit Open Source versions prior to 1.54.0 running on Windows hosts have an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. The vulnerability arises from improper validation of attacker-supplied filesystem paths. In certain code paths, including within the `ComponentRequestHandler`, filesystem paths are resolved using `os.path.realpath()` or `Path.resolve()` before sufficient validation occurs. On Windows systems, supplying a malicious UNC path (e.g., `\\attacker-controlled-host\share`) can cause the Streamlit server to initiate outbound SMB connections over port 445. When Windows attempts to authenticate to the remote SMB server, NTLMv2 challenge-response credentials of the Windows user running the Streamlit process may be transmitted. This behavior may allow an attacker to perform NTLM relay attacks against other internal services and/or identify internally reachable SMB hosts via timing analysis. The vulnerability has been fixed in Streamlit Open Source version 1.54.0.
- Product
- streamlit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026MobSF is a mobile application security testing tool used.CVE-2026-33545 · Other software · MobSF · reported by GitHubMedium 5.3
MobSF is a mobile application security testing tool used. Prior to version 4.4.6, MobSF's `read_sqlite()` function in `mobsf/MobSF/utils.py` (lines 542-566) uses Python string formatting (`%`) to construct SQL queries with table names read from a SQLite database's `sqlite_master` table. When a security analyst uses MobSF to analyze a malicious mobile application containing a crafted SQLite database, attacker-controlled table names are interpolated directly into SQL queries without parameterization or escaping. This allows an attacker to cause denial of service and achieve SQL injection. Version 4.4.6 patches the issue.
- Product
- Mobile-Security-Framework-MobSF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026H3 is a minimal H(TTP) framework.CVE-2026-33490 · Other software · h3js · reported by GitHubLow 3.7
H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch.
- Product
- h3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026Darna Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27088 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Darna Framework darna-framework allows Reflected XSS.This issue affects Darna Framework: from n/a through <= 2.9.
- Product
- Darna Framework
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update Darna Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Wolverine Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27087 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Wolverine Framework wolverine-framework allows Reflected XSS.This issue affects Wolverine Framework: from n/a through <= 1.9.
- Product
- Wolverine Framework
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Wolverine Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Handmade Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22520 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Handmade Framework handmade-framework allows Reflected XSS.This issue affects Handmade Framework: from n/a through <= 3.9.
- Product
- Handmade Framework
- Affected
- up to 3.9
- What to do
- Affects up to 3.9. Update Handmade Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2026NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution.CVE-2026-24159 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tampering.
- Product
- NeMo Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Mar 24, 2026NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution.CVE-2026-24157 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tampering.
- Product
- NeMo Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Mar 24, 2026NiceGUI is a Python-based UI framework.CVE-2026-33332 · Other software · zauberzeug · reported by GitHubMedium 6.9
NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and force the server to load entire files into memory at once. With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service. This issue has been patched in version 3.9.0.
- Product
- nicegui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Astro is a web framework.CVE-2026-33769 · Other software · withastro · reported by GitHubLow 2.9
Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. This issue has been patched in version 5.18.1.
- Product
- astro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Astro is a web framework.CVE-2026-33768 · Other software · withastro · reported by GitHubMedium 6.5
Astro is a web framework. Prior to version 10.0.2, the @astrojs/vercel serverless entrypoint reads the x-astro-path header and x_astro_path query parameter to rewrite the internal request path, with no authentication whatsoever. On deployments without Edge Middleware, this lets anyone bypass Vercel's platform-level path restrictions entirely. The override preserves the original HTTP method and body, so this isn't limited to GET. POST, PUT, DELETE all land on the rewritten path. A Firewall rule blocking /admin/* does nothing when the request comes in as POST /api/health?x_astro_path=/admin/delete-user. This issue has been patched in version 10.0.2.
- Product
- astro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Astro is a web framework.CVE-2026-29772 · Other software · withastro · reported by GitHubMedium 5.9
Astro is a web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a size limit. Because JSON.parse() allocates a V8 heap object for every element in the input, a crafted payload of many small JSON objects achieves ~15x memory amplification (wire bytes to heap bytes), allowing a single unauthenticated request to exhaust the process heap and crash the server. The /_server-islands/[name] route is registered on all Astro SSR apps regardless of whether any component uses server:defer, and the body is parsed before the island name is validated, so any Astro SSR app with the Node standalone adapter is affected. This issue has been patched in version 10.0.0.
- Product
- astro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface.CVE-2026-33286 · Other software · graphiti-api · reported by GitHubCritical 9.1
Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execution vulnerability that affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary relationship names to invoke any public method on the underlying model instance, class or its associations. Any application exposing Graphiti write endpoints (create/update/delete) to untrusted users is affected. The `Graphiti::Util::ValidationResponse#all_valid?` method recursively calls `model.send(name)` using relationship names taken directly from user-supplied JSONAPI payloads, without validating them against the resource's configured sideloads. This allows an attacker to potentially run any public method on a given model instance, on the instance class or associated instances or classes, including destructive operations. This is patched in Graphiti v1.10.2. Users should upgrade as soon as possible. Some workarounds are available. Ensure Graphiti write endpoints (create/update) are not accessible to untrusted users and/or apply strong authentication and authorization checks before any w
- Product
- graphiti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Salvo is a Rust web framework.CVE-2026-33242 · Other software · salvo-rs · reported by GitHubHigh 7.5
Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerability in the salvo-proxy component. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths (e.g., protected endpoints or administrative dashboards). This issue stems from the encode_url_path function, which fails to normalize "../" sequences and inadvertently forwards them verbatim to the upstream server by not re-encoding the "." character. Version 0.89.3 contains a patch.
- Product
- salvo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Salvo is a Rust web framework.CVE-2026-33241 · Other software · salvo-rs · reported by GitHubHigh 8.7
Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations (`form_data()` method and `Extractible` macro) do not enforce payload size limits before reading request bodies into memory. This allows attackers to cause Out-of-Memory (OOM) conditions by sending extremely large payloads, leading to service crashes and denial of service. Version 0.89.3 contains a patch.
- Product
- salvo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework.CVE-2026-33176 · Other software · rails · reported by GitHubMedium 6.6
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- Product
- activesupport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework.CVE-2026-33170 · Other software · rails · reported by GitHubMedium 5.3
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- Product
- activesupport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework.CVE-2026-33169 · Other software · rails · reported by GitHubMedium 6.9
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- Product
- activesupport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Action View provides conventions and helpers for building web pages with the Rails framework.CVE-2026-33168 · Other software · rails · reported by GitHubLow 2.3
Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- Product
- actionview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Action Pack is a Rubygem for building web applications on the Rails framework.CVE-2026-33167 · Other software · rails · reported by GitHubLow 1.3
Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.
- Product
- actionpack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS.CVE-2026-27131 · Other software · putyourlightson · reported by GitHubMedium 5.5
The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other sensitive configuration data, in addition to running the `hashData()` signing function. This issue was mitigated in versions 3.15.2 and 2.15.2 by disabling access to the Sprig Playground entirely when `devMode` is disabled, by default. It is possible to override this behavior using a new `enablePlaygroundWhenDevModeDisabled` that defaults to `false`.
- Product
- craft-sprig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Avo is a framework to create admin panels for Ruby on Rails apps.CVE-2026-33209 · Other software · avo-hq · reported by GitHubMedium 5.3
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting (XSS) vulnerability exists in the return_to query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is executed when he clicks a dynamically generated navigation button. This issue has been patched in version 3.30.3.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.