Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,626 results · page 28 of 93
Apr 17, 2026xrdp is an open source RDP server.CVE-2026-33689 · Other software · neutrinolabs · reported by GitHubHigh 8.7
xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the pre-authentication RDP message parsing logic. A remote, unauthenticated attacker can trigger this flaw by sending a specially crafted sequence of packets during the initial connection phase. This vulnerability results from insufficient validation of input buffer lengths before processing dynamic channel communication. Successful exploitation can lead to a denial-of-service (DoS) condition via a process crash or potential disclosure of sensitive information from the service's memory space. This issue has been fixed in version 0.10.6.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026xrdp is an open source RDP server.CVE-2026-33145 · Other software · neutrinolabs · reported by GitHubMedium 6.3
xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to unsafe handling of the AlternateShell parameter in xrdp-sesman. When the AllowAlternateShell setting is enabled (which is the default when not explicitly configured), xrdp accepts a client-supplied AlternateShell value and executes it via /bin/sh -c during session initialization. This results in shell-interpreted execution of unsanitized, user-controlled input. This behavior effectively provides a scriptable remote command execution primitive over RDP within the security context of the authenticated user, occurring prior to normal window manager startup. This can bypass expected session initialization flows and operational assumptions that restrict execution to interactive desktop environments. This issue has been fixed in version 0.10.6.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026xrdp is an open source RDP server.CVE-2026-33516 · Other software · neutrinolabs · reported by GitHubHigh 7.7
xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bounds read vulnerability during the RDP capability exchange phase. The issue occurs when memory is accessed before validating the remaining buffer length. A remote, unauthenticated attacker can trigger this vulnerability by sending a specially crafted Confirm Active PDU. Successful exploitation could lead to a denial of service (process crash) or potential disclosure of sensitive information from the process memory. This issue has been fixed in version 0.10.6.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026xrdp is an open source RDP server.CVE-2026-32624 · Other software · neutrinolabs · reported by GitHubMedium 6.3
xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in its logon processing. In environments where domain_user_separator is configured in xrdp.ini, an unauthenticated remote attacker can send a crafted, excessively long username and domain name to overflow the internal buffer. This can corrupt adjacent memory regions, potentially leading to a Denial of Service (DoS) or unexpected behavior. The domain_name_separator directive is commented out by default, systems are not affected by this vulnerability unless it is intentionally configured. This issue has been fixed in version 0.10.6.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026xrdp is an open source RDP server.CVE-2026-32623 · Other software · neutrinolabs · reported by GitHubHigh 7.7
xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the module fails to properly validate the size of reassembled fragmented virtual channel data against its allocated memory buffer. A malicious downstream RDP server (or an attacker capable of performing a Man-in-the-Middle attack) could exploit this flaw to cause memory corruption, potentially leading to a Denial of Service (DoS) or Remote Code Execution (RCE). The NeutrinoRDP module is not built by default. This vulnerability only affects environments where the module has been explicitly compiled and enabled. Users can verify if the module is built by checking for --enable-neutrinordp in the output of the xrdp -v command. This issue has been fixed in version 0.10.6.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026xrdp is an open source RDP server.CVE-2026-32107 · Other software · neutrinolabs · reported by GitHubHigh 8.8
xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system. An additional exploit would be needed to facilitate this. This issue has been fixed in version 0.10.6.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026xrdp is an open source RDP server.CVE-2026-32105 · Other software · neutrinolabs · reported by GitHubCritical 9.3
xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary implementation to validate the 8-byte integrity signature, causing it to be silently ignored. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing check to modify encrypted traffic in transit without detection. It does not affect connections where the TLS security layer is enforced. This issue has been fixed in version 0.10.6. If users are unable to immediately upgrade, they should configure xrdp.ini to enforce TLS security (security_layer=tls) to ensure end-to-end integrity.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026DataEase is an open source data visualization analysis tool.CVE-2026-33082 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization analysis tool. Versions 2.10.20 and below contain a SQL injection vulnerability in the dataset export functionality. The expressionTree parameter in POST /de2api/datasetTree/exportDataset is deserialized into a filtering object and passed to WhereTree2Str.transFilterTrees for SQL translation, where user-controlled values in "like" filter terms are directly concatenated into SQL fragments without sanitization. An attacker can inject arbitrary SQL commands by escaping the string literal in the filter value, enabling blind SQL injection through techniques such as time-based extraction of database information. This issue has been fixed in version 2.10.21.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Dgraph is an open source distributed GraphQL database.CVE-2026-40173 · Other software · dgraph-io · reported by GitHubCritical 9.4
Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debug/pprof/cmdline endpoint is registered on the default mux and reachable without authentication, exposing the full process command line including the admin token configured via the --security "token=..." startup flag. An attacker can retrieve the leaked token and reuse it in the X-Dgraph-AuthToken header to gain unauthorized access to admin-only endpoints such as /admin/config/cache_mb, bypassing the adminAuthHandler token validation. This enables unauthorized privileged administrative access including configuration changes and operational control actions in any deployment where the Alpha HTTP port is reachable by untrusted parties. This issue has been fixed in version 25.3.2.
- Product
- dgraph
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026SpiceDB is an open source database system for creating and managing security-critical application permissions.CVE-2026-40091 · Other software · authzed · reported by GitHubMedium 6
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in version 1.51.1. If users are unable to immediately upgrade, they can work around this issue by changing the log level to warn or error.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Jellyfin is an open source self hosted media server.CVE-2026-35034 · Other software · jellyfin · reported by GitHubMedium 6.5
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By sending large payloads combined with arbitrary group IDs, an attacker can lock out the endpoint for other clients attempting to join SyncPlay groups and significantly increase the memory usage of the Jellyfin process, potentially leading to an out-of-memory crash. This issue has been fixed in version 10.11.7.
- Product
- jellyfin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Jellyfin is an open source self hosted media server.CVE-2026-35033 · Other software · jellyfin · reported by GitHubCritical 9.3
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds any lowercase query parameter to a dictionary without validation, bypassing the RegularExpression attribute on the level controller parameter, and the unsanitized value is concatenated directly into the ffmpeg command line. By injecting a drawtext filter with a textfile argument, an attacker can read arbitrary server files such as /etc/shadow and exfiltrate their contents as text rendered in the video stream response. The vulnerable /Videos/{itemId}/stream endpoint has no Authorize attribute, making this exploitable without authentication, though item GUIDs are pseudorandom and require an authenticated user to obtain. This issue has been fixed in version 10.11.7.
- Product
- jellyfin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Jellyfin is an open source self hosted media server.CVE-2026-35032 · Other software · jellyfin · reported by GitHubHigh 8.6
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the LiveTV M3U tuner endpoint (POST /LiveTv/TunerHosts), where the tuner URL is not validated, allowing local file read via non-HTTP paths and Server-Side Request Forgery (SSRF) via HTTP URLs. This is exploitable by any authenticated user because the EnableLiveTvManagement permission defaults to true for all new users. An attacker can chain these vulnerabilities by adding an M3U tuner pointing to an attacker-controlled server, serving a crafted M3U with a channel pointing to the Jellyfin database, exfiltrating the database to extract admin session tokens, and escalating to admin privileges. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can disable Live TV Management privileges for all users.
- Product
- jellyfin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Jellyfin is an open source self hosted media server.CVE-2026-35031 · Other software · jellyfin · reported by GitHubCritical 9.9
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. This arbitrary file write can be chained into arbitrary file read via .strm files, database extraction, admin privilege escalation, and ultimately remote code execution as root via ld.so.preload. Exploitation requires an administrator account or a user that has been explicitly granted the "Upload Subtitles" permission. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can grant non-administrator users Subtitle upload permissions to reduce attack surface.
- Product
- jellyfin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026openITCOCKPIT is an open source monitoring tool built for different monitoring engines.CVE-2026-24893 · Other software · openITCOCKPIT · reported by GitHubHigh 8.8
openITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Community Edition prior to version 5.5.2 contains a command injection vulnerability that allows an authenticated user with permission to add or modify hosts to execute arbitrary OS commands on the monitoring backend. The vulnerability arises because user-controlled host attributes (specifically the host address) are expanded into monitoring command templates without validation, escaping, or quoting. These templates are later executed by the monitoring engine (Nagios/Icinga) via a shell, resulting in remote code execution. Version 5.5.2 patches the issue.
- Product
- openITCOCKPIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026EspoCRM is an open source customer relationship management application.CVE-2026-33740 · Other software · espocrm · reported by GitHubMedium 5.4
EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Email/importEml endpoint contains an Insecure Direct Object Reference (IDOR) vulnerability where the attacker-supplied fileId parameter is used to fetch any attachment directly from the repository without verifying that the current user has authorization to access it. Any authenticated user with Email:create and Import permissions can exploit this to read another user's .eml attachment contents by importing them as a new email into the attacker's mailbox, while the original victim attachment record is deleted as a side effect of the import flow. This is inconsistent with the standard attachment download path, which enforces ACL checks before returning file data, and is practically exploitable because attachment IDs are commonly exposed in normal UI and API workflows such as stream payloads and download links. This issue is fixed in version 9.3.4.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026EspoCRM is an open source customer relationship management application.CVE-2026-33659 · Other software · espocrm · reported by GitHubLow 3.5
EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Attachment/fromImageUrl endpoint is vulnerable to Server-Side Request Forgery (SSRF) via a DNS rebinding (TOCTOU) condition. Host validation uses dns_get_record() but the actual HTTP request resolves hostnames through curl's internal resolver (gethostbyname()), allowing the two lookups to return different IP addresses for the same hostname. A secondary issue exists where an empty DNS result (due to DNS failure, IPv6-only domains, or non-existent hostnames) causes the validation to implicitly allow the host without further checks. An authenticated attacker with default attachment creation access can exploit this gap to bypass internal IP restrictions and scan internal network ports, confirm the existence of internal hosts, and interact with internal HTTP-based services, though data extraction from binary protocol services and remote code execution are not possible through this endpoint. This issue has been fixed in version 9.3.4.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026EspoCRM is an open source customer relationship management application.CVE-2026-33657 · Other software · espocrm · reported by GitHubMedium 4.6
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have a stored HTML injection vulnerability that allows any authenticated user with standard (non-administrative) privileges to inject arbitrary HTML into system-generated email notifications by crafting malicious content in the post field of stream activity notes. The vulnerability exists because server-side Handlebars templates render the post field using unescaped triple-brace syntax, the Markdown processor preserves inline HTML by default, and the rendering pipeline explicitly skips sanitization for fields present in additionalData, creating a path where attacker-controlled HTML is accepted, stored, and rendered directly into emails without any escaping. Since the emails are sent using the system's configured SMTP identity (such as an administrative sender address), the injected content appears fully trusted to recipients, enabling phishing attacks, user tracking via embedded resources like image beacons, and UI manipulation within email content. The @mention feature further increases the impact by allowing targeted delivery of malicious emails to specific users. This issue has been
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026EspoCRM is an open source customer relationship management application.CVE-2026-33534 · Other software · espocrm · reported by GitHubMedium 4.3
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation (e.g., 0177.0.0.1 instead of 127.0.0.1). This is caused by HostCheck::isNotInternalHost() function relying on PHP's filter_var(..., FILTER_VALIDATE_IP), which does not recognize alternative IP formats, causing the validation to fall through to a DNS lookup that returns no records and incorrectly treats the host as safe, however the cURL subsequently normalizes the address and connects to the loopback destination. Through the confirmed /api/v1/Attachment/fromImageUrl endpoint, an authenticated user can force the server to make requests to loopback-only services and store the fetched response as an attachment. This vulnerability is distinct from CVE-2023-46736 (which involved redirect-based SSRF) and may allow access to internal resources reachable from the application runtime. This issue has been fixed in version 9.3.4.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Integer overflow or wraparound vulnerability in Samsung Open Source Escargot allows undefined behavior.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c6CVE-2026-40447 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.1
Integer overflow or wraparound vulnerability in Samsung Open Source Escargot allows undefined behavior.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.This issue affects EscarCVE-2026-40446 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 6.9
Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520CVE-2026-25209 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 6.5
Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.CVE-2026-25208 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comHigh 8.1
Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.CVE-2026-25207 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comHigh 7.4
Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520CVE-2026-25206 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 6.7
Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows out-of-bounds write.This issue affects Escargot:commit hash 97e8115ab1110bc502bCVE-2026-25205 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comHigh 7.4
Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows out-of-bounds write.This issue affects Escargot:commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335 .
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2026Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process abort.CVE-2026-25204 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 6.2
Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process abort. This issue affects escarogt prior to commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026Saltcorn is an extensible, open source, no-code database application builder.CVE-2026-40163 · Other software · saltcorn · reported by GitHubHigh 8.2
Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the server filesystem. The GET /sync/upload_finished endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files. This vulnerability is fixed in 1.4.5, 1.5.5, and 1.6.0-beta.4.
- Product
- saltcorn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables.CVE-2026-39980 · Other software · OpenCTI-Platform · reported by GitHubCritical 9.1
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform process during notifier template execution. This vulnerability is fixed in 6.9.5.
- Product
- opencti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026MISP is an open source threat intelligence and sharing platform.CVE-2026-39962 · Other software · MISP · reported by GitHubHigh 8.8
MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthenticate.php allows LDAP injection via an unsanitized username value when ApacheAuthenticate.apacheEnv is configured to use a user-controlled server variable instead of REMOTE_USER (such as in certain proxy setups). An attacker able to control that value can manipulate the LDAP search filter and potentially bypass authentication constraints or cause unauthorized LDAP queries. This vulnerability is fixed in 2.5.36.
- Product
- MISP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Vim is an open source, command line text editor.CVE-2026-39881 · Other software · vim · reported by GitHubMedium 5
Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Kamailio is an open source implementation of a SIP Signaling Server.CVE-2026-39864 · Other software · kamailio · reported by GitHubMedium 4.4
Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.0.5 and 5.8.7, an out-of-bounds read in the auth module of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process crash) via a specially crafted SIP packet if a successful user authentication without a database backend is followed by additional user identity checks. This vulnerability is fixed in 6.0.5 and 5.8.7.
- Product
- kamailio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Kamailio is an open source implementation of a SIP Signaling Server.CVE-2026-39863 · Other software · kamailio · reported by GitHubHigh 7.5
Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access in the core of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process crash) via a specially crafted data packet sent over TCP. The issue impacts Kamailio instances having TCP or TLS listeners. This vulnerability is fixed in 5.1.1, 6.0.6, and 5.8.8.
- Product
- kamailio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-39362 · Other software · inventree · reported by GitHubMedium 5.3
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, when INVENTREE_DOWNLOAD_FROM_URL is enabled (opt-in), authenticated users can supply remote_image URLs that are fetched server-side via requests.get() with only Django's URLValidator check. There is no validation against private IP ranges or internal hostnames. Redirects are followed (allow_redirects=True), enabling bypass of any URL-format checks. This vulnerability is fixed in 1.2.7 and 1.3.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-35479 · Other software · inventree · reported by GitHubMedium 6.6
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring "superuser" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentially harmful) plugins. This vulnerability is fixed in 1.2.7 and 1.3.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.inventree.orgdocs.inventree.org
Apr 8, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-35478 · Other software · inventree · reported by GitHubHigh 8.3
InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST /api/user/tokens/ request. The returned token is immediately usable for full API authentication as the target user, from any network location, with no further interaction required. This vulnerability is fixed in 1.2.7 and 1.3.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-35477 · Other software · inventree · reported by GitHubMedium 5.5
InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed jinja2.Environment. Additionally, the validator uses a dummy Part instance with pk=None, which allows conditional template expressions to behave differently during validation versus production rendering. A staff user with settings access can craft a template that passes validation but executes arbitrary code during rendering. This issue requires access by a user with granted staff permissions. This vulnerability is fixed in 1.2.7 and 1.3.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-35476 · Other software · inventree · reported by GitHubHigh 7.2
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.inventree.orggithub.com
Apr 8, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-34837 · Other software · zammad · reported by GitHubMedium 5.3
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, he REST endpoint POST /api/v1/ai_assistance/text_tools/:id contains an authorization failure. Context data (e.g., a group or organization) supplied to be used in the AI prompt were not checked if they are accessible for the current user. This leads to having data present in the AI prompt that were not authorized before being used. A user needs to have ticket.agent permission to be able to use the provided context data. This vulnerability is fixed in 7.0.1.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-34782 · Other software · zammad · reported by GitHubMedium 5.3
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id was not checking if a user is privileged to use the text tool, resulting in being able to use it in all situations. This vulnerability is fixed in 7.0.1 and 6.5.4.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-34724 · Other software · zammad · reported by GitHubHigh 8.7
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or influence type_enrichment_data (typically high-privilege administrative configuration). This vulnerability is fixed in 7.0.1.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-34723 · Other software · zammad · reported by GitHubHigh 8.7
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, unauthenticated remote attackers were able to access the getting started endpoint to get access to sensitive internal entity data, even after the system setup was completed. This vulnerability is fixed in 7.0.1 and 6.5.4.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-34722 · Other software · zammad · reported by GitHubMedium 6.9
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-34721 · Other software · zammad · reported by GitHubMedium 5.9
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the OAuth callback endpoints for Microsoft, Google, and Facebook external credentials do not validate a CSRF state parameter. This vulnerability is fixed in 7.0.1 and 6.5.4.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-34720 · Other software · zammad · reported by GitHubLow 2.3
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the SSO mechanism in Zammad was not verifying the header originates from a trusted SSO proxy/gateway before applying further actions on it. This vulnerability is fixed in 7.0.1 and 6.5.4.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-34719 · Other software · zammad · reported by GitHubHigh 8.3
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back addresses, or link-local addresses — only the URL scheme (HTTP/HTTPS) as well as the hostname was checked. This could end up in retrieving confidential metadata of cloud/hosting providers. The existing check is now extended and is applied when configuring webhooks as well as triggering webhook jobs. This vulnerability is fixed in 7.0.1 and 6.5.4.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-34718 · Other software · zammad · reported by GitHubMedium 5.3
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitization of data: ... URI schemes, resulting in storing such malicious content in the database of the Zammad instance. The Zammad GUI is rendering this content, due to applied CSP rules no harm was done by e.g., clicking such a link. This vulnerability is fixed in 7.0.1 and 6.5.4.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-34248 · Other software · zammad · reported by GitHubLow 2.1
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, customers in shared organizations (means they can see each other's tickets) could see fields which are not intended for customers - including fields not intended for them at all (e.g. priority, custom ticket attributes for internal purposes). This was the case when a customer opened a ticket from another user of the same shared organization. They are not able to modify these field. This vulnerability is fixed in 7.0.1.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Fleet is open source device management software.CVE-2026-27806 · Other software · fleetdm · reported by GitHubHigh 7.8
Fleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local user's password via a GUI dialog and interpolates it directly into a Tcl/expect script executed via exec.Command("expect", "-c", script). Because the password is inserted into Tcl brace-quoted send {%s}, a password containing } terminates the literal and injects arbitrary Tcl commands. Since Orbit runs as root, this allows a local unprivileged user to escalate to root privileges. This vulnerability is fixed in 4.81.1.
- Product
- fleet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework.CVE-2026-32712 · Other software · opensourcepos · reported by GitHubMedium 5.4
Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Daily Sales management table. The customer_name column is configured with escape: false in the bootstrap-table column configuration, causing customer names to be rendered as raw HTML. An attacker with customer management permissions can inject arbitrary JavaScript into a customer's first_name or last_name field, which executes in the browser of any user viewing the Daily Sales page. This vulnerability is fixed in 3.4.3.
- Product
- opensourcepos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.