Updated 29 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

439new WordPress flaws this week

394,398entries in the database

331,033 results · page 28 of 6621

Nov 4, 2026zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR andCVE-2026-121946 · Other software · zbateson · reported by VulnCheckMedium 6.9
zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such as a forged Bcc into outgoing messages.
Product
mail-mime-parser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident CVE-2026-121945 · Other software · CoopCycle · reported by VulnCheckHigh 7.2
CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/{id}/action to re-price, cancel or reschedule other stores' orders and tasks.
Product
coopcycle-web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows attackers to cause denial of service via CVE-2026-121944 · Other software · irontec · reported by VulnCheckMedium 6.8
sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows attackers to cause denial of service via crafted NFLOG TLVs. Attackers can supply a pcap file with link type NFLOG containing a non-payload TLV with length under 4, making the capture thread spin at full CPU and stop processing packets.
Product
sngrep
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length checkCVE-2026-121943 · Other software · irontec · reported by VulnCheckMedium 6.3
Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.
Product
sngrep
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap memory outside the imCVE-2026-121942 · Other software · mchehab · reported by VulnCheckMedium 6.9
ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked sample coordinates that crash the decoder and leak bytes into output.
Product
zbar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation CVE-2026-121941 · Other software · munt · reported by VulnCheckHigh 8.5
libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emu_parse_stream API via MIDI files, ports, or sequencer clients to corrupt heap memory and crash the application.
Product
libmt32emu
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projectsCVE-2026-121940 · Other software · Stonewuu · reported by VulnCheckHigh 8.7
Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to read, overwrite, cascade-delete data, and add themselves as project members.
Product
ai-fusion-video
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users byCVE-2026-121939 · Other software · David-Crty · reported by VulnCheckCritical 9.2
Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including the super-admin, and retain access after password resets.
Product
Databasement
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chaCVE-2026-121938 · Other software · moyangzhan · reported by VulnCheckMedium 6
langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims' questions, AI answers, and attachment and audio URLs.
Product
langchain4j-aideepin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flCVE-2026-121937 · Other software · blackholll · reported by VulnCheckLow 2.3
loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticket_flow_history endpoint, which skips ticket_view_permission_check, to obtain approval comments and processor names, emails and phone numbers.
Product
loonflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by suppCVE-2026-121936 · Other software · cosin2077 · reported by VulnCheckMedium 6.9
easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflected error messages in the x-generate-tts-warning header to probe internal hosts and ports.
Product
easyVoice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events CVE-2026-121620 · Other software · CoopCycle · reported by VulnCheckHigh 8.3
CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states.
Product
coopcycle-web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content attributes of meta tagCVE-2026-121373 · Other software · sensiolabs · reported by 596c5446-0ce5-4ba2-aa66-48b3b757a647Medium 5.3
The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content attributes of meta tags using a regular expression that is too narrow, allowing sanitization to be bypassed, and resulting in potential URL redirection to untrusted sites in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The shared declarative refresh steps in the WHATWG HTML Standard require a broader approach: the separator after the time may be ASCII whitespace alone, with no ; or ,, and the url= keyword is optional. Directives the browser honours, but the regular expression misses are returned unchanged, so the attacker URL skips UrlSanitizer entirely and both allowLinkSchemes and allowLinkHosts are defeated for the refresh navigation. This is reachable under any configuration that allows meta with http-equiv and content, including the documented allowStaticElements() preset.
Product
symfony
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configCVE-2026-121147 · Other software · Tata Motors · reported by vdisclose@cert-in.org.inHigh 8.5
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services.
Product
Tata Motors iRA 2.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in
Nov 4, 2026This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development aCVE-2026-121146 · Other software · Tata Motors · reported by vdisclose@cert-in.org.inMedium 6.8
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session tokens. Successful exploitation of this vulnerability could allow the attacker to impersonate the associated user and gain unauthorized access to vehicle related information and services.
Product
Tata Motors iRA 2.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in
Nov 4, 2026This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component.CVE-2026-121145 · Other software · Tata Motors · reported by vdisclose@cert-in.org.inHigh 7.1
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of this vulnerability could allow the attacker to perform unauthorized interaction with application functionality, obtain live bearer authentication tokens and potentially impersonate the associated user and access vehicle related information and services.
Product
Tata Motors iRA 2.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in
Nov 4, 2026This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokCVE-2026-121144 · Other software · Tata Motors · reported by vdisclose@cert-in.org.inHigh 8.8
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application package and extracting embedded sensitive information. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to associated backend services and potentially access sensitive information or perform unauthorized operations on the targeted system.
Product
Tata Motors iRA 2.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in
Nov 4, 2026The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules toCVE-2026-118516 · Other software · sensiolabs · reported by 596c5446-0ce5-4ba2-aa66-48b3b757a647Medium 6.3
The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. For routes that define a host, CompiledUrlMatcher matches the string $host.'.'.$pathinfo against the host regular expression followed by the path regular expression, while UrlMatcher matches the host and the path separately. A host placeholder can therefore match /, and consume the beginning of the path, so the request is routed to a controller, while UrlMatcher would find no route. Rules that look at the path, such as access_control entries and firewall patterns, are evaluated against the actual request path, so they do not apply while the controller of the route runs, potentially allowing an unauthenticated request to reach a protected controller. For example, with the route /admin/report/{id}, the host app.{domain} and the rule access_control: [{ path: ^/admin, roles: ROLE_ADMIN }], an anonymous request for /admin/report/1 is sent to the login page. A request with the Host header app and path /x./admi
Product
symfony
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4CVE-2026-118513 · Other software · sensiolabs · reported by 596c5446-0ce5-4ba2-aa66-48b3b757a647High 7.7
Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted CA who can influence the CN to authenticate as an arbitrary user of the application, including a privileged one, following an incomplete fix for CVE-2026-45063. X509Authenticator extracts the user identifier from the Subject DN (Distinguished Name) that the web server passes in $_SERVER['SSL_CLIENT_S_DN']. The fix for CVE-2026-45063 anchored that extraction to an RDN (Relative Distinguished Name) boundary, but the regular expression used was not escape-aware. The expression runs against an already serialized DN, so it cannot tell an RDN separator from a separator character that occurs inside a value. Under RFC 2253, used by Apache and by nginx's $ssl_client_s_dn, a comma inside a value is escaped as \, and the expression reads it as a separator regardless. RFC 2253 also does not treat / as a separator, so it leaves it bare inside a value, while the expression treats every / as one. The legacy X509_NAME_oneline() format, used
Product
symfony
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module impacts the Qt Framework.CVE-2026-107479 · Other software · qt · reported by a59d8014-47c4-4630-ab43-e1b13cbe58e3Low 1.7
An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module impacts the Qt Framework. An application using the affected functionality could crash.
Product
Qt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codereview.qt-project.org wiki.qt.io
Nov 4, 2026Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance: Stored Cross-Site ScriptingCVE-2026-97397 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the plugin's Remove mode to be active and the malicious comment to be published, either through auto-approval for known commenters or manual moderator approval.
Product
Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance
Affected
up to 1.7
What to do
Affects up to 1.7. Update Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2026A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier.CVE-2026-59267 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.8
A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Product
Apache OpenOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-bCVE-2026-121925 · Other software · Snowflake · reported by 412d305a-227d-44f9-a262-a31ba44f2aeaMedium 6.6
A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's HTML response into a fixed-size memory buffer without first validating the length of that value. An attacker who controlled or had compromised the configured identity provider — or who was able to redirect the SAML single sign-on endpoint to an attacker-controlled server — might have leveraged this by returning an oversized response, potentially resulting in a crash or, in specific circumstances, remote code execution within the context of the application running the library. The fix is available in libsnowflakeclient version 2.11.1 and Snowflake PHP PDO Driver version 4.3.0. Users must manually upgrade.
Product
Snowflake PHP PDO Driver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.snowflake.com github.com
Nov 4, 2026Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an attacker to interfere with a user'sCVE-2026-114456 · Other software · Snowflake · reported by 412d305a-227d-44f9-a262-a31ba44f2aeaMedium 6.5
Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener reflected an arbitrary request's Origin header into its CORS response headers and accepted the first token-bearing request it received during the login window without verifying a CSRF state value bound to that specific login attempt. An attacker able to reach the listener during an active login might have leveraged this to submit a forged callback response, causing the authentication attempt to fail. The fix is available in Snowflake Connector for Python 4.8.0, Snowflake Go Driver v2.3.0, Snowflake JDBC Driver 4.4.0 (including the snowflake-jdbc-fips and snowflake-jdbc-thin artifacts), Snowflake Node.js Driver 3.4.0, Snowflake Connector for .NET 6.3.0, Snowflake ODBC Driver 4.0.0, Snowflake PHP PDO Driver 4.3.0, and libsnowflakeclient 2.11.1. Go v1 users must migrate to the latest major version of the module. Users must manually upgrade.
Product
Snowflake Connector for Python
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.snowflake.com docs.snowflake.com
Nov 4, 2026An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, cCVE-2026-90634 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Product
Apache OpenOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026Apache OpenOffice documents can include multimedia content (audio, video, etc.) A crafted document could exploit the GStreamer multimedia component of Apache OCVE-2026-90632 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.5
Apache OpenOffice documents can include multimedia content (audio, video, etc.) A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Product
Apache OpenOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026Apache OpenOffice documents can contain links.CVE-2026-90631 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 3.3
Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process. This issue affects Apache OpenOffice: through 4.1.16. Users are recommended to upgrade to version 4.1.17, which fixes the issue.
Product
Apache OpenOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, cCVE-2026-90629 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Product
Apache OpenOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, cCVE-2026-90628 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Product
Apache OpenOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the uCVE-2026-90627 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.5
The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Product
Apache OpenOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, cCVE-2026-90626 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Product
Apache OpenOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write.CVE-2026-90624 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Product
Apache OpenOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash thCVE-2026-59268 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Product
Apache OpenOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.CVE-2026-59264 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.8
The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Product
Apache OpenOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user.CVE-2026-59263 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 1.9
A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Product
Apache OpenOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026Uncontrolled recursion in Apache ZooKeeper.CVE-2026-115448 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.7
Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes (the default root ACL is open) can build a chain of nested znodes deep enough that taking a snapshot exhausts the JVM stack and kills the snapshot thread; sizes stay within jute.maxbuffer, so existing limits do not prevent it. This is a denial of service that becomes persistent: on restart the server rebuilds the deep tree from its transaction log and fails again while taking the startup snapshot, so it does not return to service, and recovery can entail data loss. The same log affects a leader and its followers, so it can spread across an ensemble. This issue affects Apache ZooKeeper 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6. Users are recommended to upgrade to 3.8.8 or 3.9.7, which fix the issue. As a workaround, use ACLs and authentication to restrict znode creation rather than relying on the default open root ACL.
Product
Apache ZooKeeper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.CVE-2026-108946 · Websites & servers · Apache Software Foundation · reported by security@apache.org
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client to spoof another user's ids. This allows: * an authenticated client consumes from another connection's temporary queue/topic by putting the victim's connection id in its own ConsumerId, bypassing the broker-side ownership check. * a duplicate ConsumerId registration is only logged, after which the attacker's RemoveInfo or disconnect tears down the victim's live subscription * a forged MessageAck for the victim's ConsumerId permanently deletes an in-flight, unacknowledged message. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.
Product
Apache ActiveMQ
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destiCVE-2026-108500 · Websites & servers · Apache Software Foundation · reported by security@apache.org
Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups. This issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
Product
Apache ActiveMQ
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0.CVE-2026-103582 · Websites & servers · Apache Software Foundation · reported by security@apache.org
Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0. The OpenWire unmarshalling code trusted the frame size and the length and count fields read from the network. It did not enforce a maximum frame size, and it did not check that decoded lengths fit within the frame being read. A malicious or compromised broker, or an attacker able to intercept and modify an unencrypted connection, could send a crafted OpenWire frame with an oversized or negative length. This could cause the client to attempt very large memory allocations, leading to excessive memory consumption, an OutOfMemoryException or an uncaught exception, and a denial of service of the client application. Users are recommended to upgrade to version 2.3.0, which enforces a configurable maximum frame size and validates lengths against the size of the frame being read.
Product
Apache ActiveMQ NMS OpenWire Client Library
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a bCVE-2026-102704 · Other software · Xen · reported by security@xen.orgMedium 4.4
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches details internally to reuse already validated data. The conditions on when to re-validate the internal data were not correct in some cases: - Frame numbers and grant references could wrongly be mixed up. This is CVE-2026-102703. - Copying by frame number (rather than grant reference) is permitted only when operating on the caller's own memory. The check to enforce this restriction was misplaced. This is CVE-2026-102704.
Product
Xen
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record xenbits.xenproject.org
Nov 4, 2026[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a bCVE-2026-102703 · Other software · Xen · reported by security@xen.orgMedium 4.4
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches details internally to reuse already validated data. The conditions on when to re-validate the internal data were not correct in some cases: - Frame numbers and grant references could wrongly be mixed up. This is CVE-2026-102703. - Copying by frame number (rather than grant reference) is permitted only when operating on the caller's own memory. The check to enforce this restriction was misplaced. This is CVE-2026-102704.
Product
Xen
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record xenbits.xenproject.org
Nov 4, 2026Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial oCVE-2026-100302 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.1
Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request. The multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire — within the jute.maxbuffer limit — but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response. This issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.
Product
Apache ZooKeeper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unaCVE-2026-100300 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.7
Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data directory permanently unbootable. This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
Product
Apache ZooKeeper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026Improper Authorization vulnerability in Apache ZooKeeper.CVE-2026-100252 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.6
Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.auth_to_local rules. If no rule applies to the principal, canonicalization fails and the error is only logged. The client-requested authzid then becomes the session's SASL identity for all ACL checks. An authenticated client whose principal is not covered by the auth_to_local rules can therefore claim any SASL identity. With the default rules, this includes any Kerberos principal from a realm other than the server's default realm, such as a principal from a cross-realm trusted realm. The client then gets the permissions granted to that identity in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets superuser access to the whole data tree. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the iss
Product
Apache ZooKeeper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper.CVE-2026-100235 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6
Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepared (and authorized) after the setACL is submitted but before it commits is therefore checked against the previous, pre-revocation ACL, yet is applied to the data tree after the ACL change has taken effect. A client that currently holds a permission can use this window to perform operations requiring that permission through and after its revocation — for example, committing writes or deletes after losing write access, or re-granting itself full permissions, which persistently defeats the revocation. In deployments transitioning from the default OPEN_ACL_UNSAFE ACL to a restrictive ACL, any unauthenticated client can exploit this during the transition. This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
Product
Apache ZooKeeper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 4, 2026IRISPowerscan insufficiently restrict the use of untrusted scripts.CVE-2026-95649 · Other software · I.R.I.S S.A. · reported by 4586e0a2-224d-4f8a-9cb4-8882b208c0b3Medium 6.1
IRISPowerscan insufficiently restrict the use of untrusted scripts. An authenticated user with access to script functionality can import or modify scripts that are executed by the application, potentially resulting in arbitrary code execution in the security context of the Windows user running IRISPowerscan.
Product
IRISPowerscan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record canon-europe.com
Nov 4, 2026IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predictable password, whiCVE-2026-94460 · Other software · I.R.I.S S.A. · reported by 4586e0a2-224d-4f8a-9cb4-8882b208c0b3High 7.2
IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predictable password, which could allow an unauthenticated attacker to gain unauthorised access to privileged application functionality.
Product
IRISPowerscan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record canon-europe.com
Nov 4, 2026IRISPowerscan contain default user accounts with predictable credentials.CVE-2026-94459 · Other software · I.R.I.S S.A. · reported by 4586e0a2-224d-4f8a-9cb4-8882b208c0b3High 7.2
IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installation could use these credentials to authenticate to the application and access functionality available to the affected accounts, potentially resulting in unauthorised access or modification of application data and configuration.
Product
IRISPowerscan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record canon-europe.com
Nov 4, 2026Simple CAPTCHA with Cloudflare Turnstile: Stored Cross-Site ScriptingCVE-2026-93900 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the [gravity-simple-turnstile] shortcode in versions up to, and including, 1.44.3 This is due to insufficient input sanitization and output escaping on the shortcode attribute in the cfturnstile_gravity_shortcode() function: the value is filtered only by esc_html() and sanitize_text_field() (neither of which touches parentheses or dots) and then emitted via esc_js() in a raw JavaScript expression context outside any string literal (esc_js only escapes quotes, backslashes, and newlines). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple CAPTCHA with Cloudflare Turnstile
Affected
up to 1.44.3
What to do
Affects up to 1.44.3. Update Simple CAPTCHA with Cloudflare Turnstile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2026Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component.CVE-2026-120422 · Other software · Sogou · reported by security@eset.comHigh 8.9
Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network traffic to replace legitimate server responses with malicious configurations. An attacker can exploit this vulnerability to instruct SGTool.exe to download attacker-controlled files to arbitrary locations, including paths used by legitimate application components. This can result in arbitrary code execution when the downloaded files are subsequently executed or loaded by the application.
Product
Sogou Input Method
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pinyin.sogou.com welivesecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.