Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,830 results · page 28 of 137
Aug 15, 2026In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_lookup: fix catchall element handling with inverted lookups nft_lookup_evalCVE-2026-72320 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.1
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_lookup: fix catchall element handling with inverted lookups nft_lookup_eval() decides whether a lookup matched (`found`) from the direct set lookup and priv->invert before falling back to the catchall element used by interval sets (e.g. nft_set_rbtree) for the open-ended default range. Since `found` is never recomputed after `ext` is replaced by the catchall lookup, inverted lookups (NFT_LOOKUP_F_INV, "!= @set") can wrongly match or wrongly skip the catchall element, producing the wrong verdict. Fold the catchall lookup into `ext` before computing `found`, matching the order already used by nft_objref_map_eval().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 14, 2026Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".CVE-2026-69414 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
- Product
- Microsoft Malware Protection Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comgithub.com
Aug 14, 2026The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially CVE-2025-7639 · Other software · AVEVA · reported by ics-cert@hq.dhs.govMedium 6.1
The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps".
- Product
- AVEVA Enterprise SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined denCVE-2026-72835 · Other software · filebrowser · reported by VulnCheckHigh 7.6
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no rule but resolve to the same filesystem object, gaining unauthorized access to denied files within their scope.
- Product
- filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 13, 2026IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-contrCVE-2026-18249 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.4
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper management of thread authority swaps.CVE-2026-18101 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper management of thread authority swaps.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from CVE-2026-72642 · Other software · Elastic · reported by security@elastic.coHigh 8.8
The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes memory outside the intended allocation. The result is heap corruption that crashes the inference process, and, with sufficient control over the heap layout, could allow arbitrary code execution in the context of that process.
- Product
- Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable.CVE-2026-16987 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper privilege management.CVE-2026-18071 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper privilege management.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while CVE-2026-73615 · Other software · Jovancoding · reported by VulnCheckHigh 8.7
Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and approval gates while the executor runs the identical unquoted dangerous argv.
- Product
- Network-AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 13, 2026Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untrCVE-2026-73614 · Other software · Jovancoding · reported by VulnCheckHigh 8.7
Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands.
- Product
- Network-AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 13, 2026Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json,CVE-2026-73484 · Other software · FlowiseAI · reported by VulnCheckHigh 8.6
Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem.
- Product
- Flowise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 12, 2026IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile namCVE-2026-17082 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special CVE-2026-16906 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special elements used in an OS command.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of special elements used in an OS command.CVE-2026-16856 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of special elements used in an OS command.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally.CVE-2026-65680 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally.
- Product
- OneDrive for MacOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate priCVE-2026-70355 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.3
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SharePoint Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-70347 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-70346 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-70345 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-70344 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.CVE-2026-70340 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
- Product
- Azure CycleCloud 8.9.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.CVE-2026-70330 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-70326 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-70324 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2026-70307 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.CVE-2026-70304 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally.CVE-2026-68821 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally.
- Product
- App Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locaCVE-2026-68792 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.CVE-2026-66804 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 22H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally.CVE-2026-66799 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Heap-based buffer overflow in Windows Storage Port Driver allows an authorized attacker to elevate privileges locally.CVE-2026-65814 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Storage Port Driver allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-65813 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.5
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Exchange Server 2016 Cumulative Update 23
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.CVE-2026-65810 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Integer overflow or wraparound in Windows DNS allows an authorized attacker to elevate privileges locally.CVE-2026-65799 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Integer overflow or wraparound in Windows DNS allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.CVE-2026-65798 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.CVE-2026-65797 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally.CVE-2026-65795 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Heap-based buffer overflow in Windows Message Queuing allows an authorized attacker to elevate privileges locally.CVE-2026-65790 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-65788 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-65787 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-65786 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.CVE-2026-65783 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.CVE-2026-65782 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.CVE-2026-65781 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally.CVE-2026-65780 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.CVE-2026-65779 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.CVE-2026-65778 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.CVE-2026-65776 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.CVE-2026-65775 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.