Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12,720 results · page 26 of 255
Sep 3, 2026Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services.CVE-2026-79679 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comHigh 7
Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit used in mapp Services: before 6.8.0.
- Product
- mapp Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-cws-assets.de-fra-1.linodeobjects.com
Sep 3, 2026Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure.CVE-2021-43614 · Other software · Insyde Software · reported by 8338d8cb-57f7-4252-abc0-96fd13e98d21Medium 6.7
Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure.
- Product
- InsydeH2O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts theCVE-2026-84851 · Other software · Amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.7
An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service.
- Product
- ion-c
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Sep 2, 2026A flaw was found in submariner.CVE-2026-66786 · Other software · Red Hat · reported by Red HatCritical 9.1
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 2, 2026Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowCVE-2026-84673 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability.
- Product
- Jenkins Customizable Header Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads RespoCVE-2026-78222 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX JavaScript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026async-tar is a tar archive reading/writing library for async Rust.CVE-2026-53600 · Other software · dignifiedquire · reported by GitHubMedium 6.3
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header (a GNU longname L, a GNU longlink K, or a PAX x/g header) instead of to the next file entry. POSIX requires a PAX extended-header record set to describe the next file entry, never an intervening extension header. Because poll_next_raw (src/archive.rs) threads the buffered PAX records into the size computation of whatever raw header it reads next — and that header can be an intermediary L — the stream cursor is advanced by an attacker-chosen amount when the L body is consumed. The parser then desyncs relative to a POSIX-correct tar parser (e.g. GNU tar), reading subsequent bytes at the wrong block boundary. This issue has been patched in version 0.6.1.
- Product
- async-tar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints.CVE-2026-84804 · Other software · kimai · reported by VulnCheckMedium 5.3
Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.
- Product
- kimai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 2, 2026Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions.CVE-2026-81771 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions.
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Advanced Custom Fields: Extended: Does not restrict the role submitted through its front-end user forms to the roles the form actually offersCVE-2026-80467 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.
- Product
- Advanced Custom Fields: Extended
- Fixed in
- 0.9.2.7
- What to do
- Update Advanced Custom Fields: Extended to 0.9.2.7 or newer.
Sep 2, 2026Advanced Custom Fields: Extended: Does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capabilityCVE-2026-12526 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing administrator (a fixed target, or one mapped to a visitor-submitted field) and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite that administrator's password and take over the account. The default target is the submitting user, so exploitation depends on the form being configured to target another account.
- Product
- Advanced Custom Fields: Extended
- Fixed in
- 0.9.2.7
- What to do
- Update Advanced Custom Fields: Extended to 0.9.2.7 or newer.
Sep 1, 2026Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.CVE-2026-81928 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises "misplaced or corrupt TSIG", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped. The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response. Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orgmetacpan.org
Sep 1, 2026WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enfCVE-2026-84476 · Other software · WWBN · reported by VulnCheckHigh 8.7
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 1, 2026Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122).CVE-2026-78607 · Other software · Elastic · reported by security@elastic.coMedium 5.4
Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.
- Product
- Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586).CVE-2026-72649 · Other software · Elastic · reported by security@elastic.coHigh 8.8
Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.
- Product
- Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hookCVE-2026-19590 · Other software · OpenAI · reported by 8f4f43ab-ba69-4d92-aa1d-d772184d6fb7High 7.3
OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.
- Product
- Codex Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61779 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61778 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61777 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61776 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61775 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61774 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61773 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61772 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61771 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61770 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61769 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61768 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61767 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61766 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61765 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61764 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61763 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61762 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61761 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61760 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61759 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61758 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61757 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61756 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61755 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61754 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61753 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61752 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61751 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61750 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd.CVE-2026-18931 · Other software · TMT Machine Industry and Trade Ltd. Co. · reported by iletisim@usom.gov.trCritical 9.1
Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Retrieve Embedded Sensitive Data. This issue affects Talassoft Industrial Management Software: from V.4 before V.16.
- Product
- Talassoft Industrial Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom vaCVE-2026-83557 · Other software · FasterXML · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 5.6
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultT
- Product
- jackson-databind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability.CVE-2026-58569 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges..
- Product
- PowerStore 500T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trade Ltd.CVE-2026-18780 · Other software · TMT Machine Industry and Trade Ltd. Co. · reported by iletisim@usom.gov.trHigh 7.1
Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16.
- Product
- Talassoft Industrial Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.