Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,161 results · page 28 of 304
Aug 5, 2026IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies.CVE-2026-15656 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
- Product
- Maximo Application Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase.CVE-2026-71291 · Other software · bolt · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.8
Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allow_twig flag and a regex checking for , , or ; when true, the raw field value is compiled and rendered via with no sandboxing.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, CVE-2026-71262 · Other software · IoTSharp · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.8
IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, TenantsController, etc.), and no global authorization FallbackPolicy is configured in Startup.cs, leaving its Upload/Download/List/Modify/Delete endpoints reachable by unauthenticated remote attackers.
- Product
- IoTSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the bCVE-2026-71232 · Other software · magicblack · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.2
MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.
- Product
- maccms10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versioCVE-2026-14304 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 4.6
In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists. If this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker.
- Product
- Eclipse Accessibility Tools Framework (ACTF)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM).CVE-2026-10090 · Other software · Red Hat · reported by Red HatCritical 9
A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies the Helm chart contents with its own elevated authority, without verifying whether the subscription creator holds the "open-cluster-management:subscription-admin" role and without restricting applied resources to the subscription namespace. This allows the attacker to include cluster-scoped resources in the Helm chart, such as a ClusterRoleBinding granting the attacker's ServiceAccount the "cluster-admin" ClusterRole. Successful exploitation results in full cluster-admin privilege escalation. This contradicts the ACM documentation which states that non-subscription-admin users should have resources deployed into the subscription namespace only.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 5, 2026The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenatCVE-2026-71207 · Other software · mrswapnilsahu · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.8
The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path.
- Product
- Stock-Inventory-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .upCVE-2026-71204 · Other software · dgtlmoon · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 6.2
changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via plCVE-2026-67979 · Other software · reported by MITRECritical 9.1
Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configurationCVE-2026-70553 · Other software · MaxSite · reported by VulnCheckCritical 9.3
MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious db_dbprefix value containing a single quote to break out of a PHP string literal in application/config/database.php, appending attacker-controlled PHP statements that are executed by the web server on every subsequent request, resulting in persistent unauthenticated remote code execution as the web-server process user.
- Product
- MaxSite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commax-3000.com
Aug 3, 2026A path traversal flaw was found in WildFly's domain mode implementation.CVE-2026-17614 · Other software · Red Hat · reported by Red HatMedium 4.4
A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A remote attacker who has obtained the slave host controller secret or compromised a slave host controller can supply a crafted relative path containing directory traversal sequences (e.g., ../../etc/passwd) via the slave-DC wire protocol, causing the Domain Controller to resolve and serve arbitrary files readable by the DC process. This leads to unauthorized disclosure of sensitive information such as configuration files, keystores, and system credentials.
- Product
- Red Hat JBoss Enterprise Application Platform 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 3, 2026A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial CVE-2026-67974 · Other software · reported by MITREHigh 7.5
A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via sending a crafted packet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl entCVE-2026-67969 · Other software · reported by MITREHigh 7.5
An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl entry.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php componeCVE-2026-51775 · Other software · reported by MITRECritical 9.8
SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter.CVE-2026-68981 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.
- Product
- Apache NiFi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 3, 2026Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.CVE-2026-69151 · Other software · angular · reported by GitHubHigh 7.6
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.
- Product
- angular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.CVE-2026-69149 · Other software · angular · reported by GitHubHigh 8.6
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.
- Product
- angular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.CVE-2026-68945 · Other software · angular · reported by GitHubHigh 8.8
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.
- Product
- angular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documeCVE-2026-18248 · Other software · @fastify/aws-lambda · reported by ce714d77-add3-4f53-aff5-83d477b104bbCritical 9.1
@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that populates this decoration reads the client-controlled x-apigateway-event and x-apigateway-context HTTP headers before falling back to the trusted internal request token, and those reserved headers are not stripped from the incoming event. An unauthenticated attacker who can set a single HTTP header can therefore forge the entire Lambda proxy event, including the authorizer context, and override the genuine one. This results in a full authentication and authorization bypass and privilege escalation for any application that trusts request.awsLambda.event for identity or access control. Only version 6.4.0 is affected. Patches: upgrade to @fastify/aws-lambda 6.4.1, which resolves the decoration only through the internal per-invocation token and strips the reserved headers before the request is processed.
- Product
- @fastify/aws-lambda
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Aug 2, 2026In imgsensor, there is a possible application crash due to incorrect error handling.CVE-2026-20486 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In imgsensor, there is a possible application crash due to incorrect error handling. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11012302; Issue ID: MSV-7833.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026GeoNetwork is a catalog application to manage spatially referenced resources.CVE-2026-53573 · Other software · geonetwork · reported by GitHubMedium 4.8
GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This issue is fixed in versions 4.2.16 and 4.4.11.
- Product
- core-geonetwork
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromCVE-2026-34490 · Other software · Johnson Controls · reported by productsecurity@jci.comMedium 4.8
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53.
- Product
- XAAP Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-moCVE-2026-17348 · Other software · pgadmin.org · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 6.9
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the same defect class previously fixed as CVE-2026-12046 (the sqleditor close/update_connection routes). A follow-up sweep, prompted by a report describing an incomplete fix for CVE-2026-12046, found further routes missing @pga_login_required: the Constraints blueprint's nodes and proplist (object listing) routes and its delete route (a state-mutating DELETE that removes table constraints); preferences.get_all_cli (GET, discloses all CLI-settable preference values); debugger.close (DELETE); and schema_diff.close (DELETE). An unauthenticated network client could therefore enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users, without ever authenticating. Fix adds the missing @pga_login_required decorator (and the corresponding import to the Constraints module) to each of th
- Product
- pgAdmin 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.CVE-2026-16504 · Other software · VPS.org · reported by cret@cert.orgCritical 9.8
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.
- Product
- Zulip template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() cCVE-2026-10685 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgHigh 7.6
The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() callback after it had already called params->notify(conn, params, NULL, 0). Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may be freed or reused by the application; calling subscribe() on the struct afterwards is a use-after-free, including an indirect call through the freed params->subscribe function pointer. The error branch is remotely (adjacent) reachable: a Zephyr device acting as a GATT client that calls bt_gatt_subscribe() can be driven into this ordering when a connected GATT server peer answers the CCC write with an ATT Error Response (the peer-supplied error code flows through att_error_rsp -> att_handle_rsp into gatt_write_ccc_rsp). For applications that free or recycle subscription parameters in their notification-termination handler, this results in memory corruption, a crash (denial of service), or potentially attacker-influenced control flow. The fix reorders the handler so the subscribe() callba
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachaCVE-2026-18064 · Other software · NASA · reported by ics-cert@hq.dhs.govHigh 8.2
An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to crash, resulting in a denial-of-service condition and processor reset.
- Product
- Core Flight System (cFS) Health & Safety (HS) Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026Sylius Mollie Plugin provides Mollie payment integration for Sylius applications.CVE-2026-68501 · Other software · Sylius · reported by GitHubMedium 6.5
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.
- Product
- MolliePlugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026Sylius Mollie Plugin provides Mollie payment integration for Sylius applications.CVE-2026-68500 · Other software · Sylius · reported by GitHubHigh 7.5
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order, allowing an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds for that order. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.
- Product
- MolliePlugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.CVE-2026-11536 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.
- Product
- WebSphere Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service viaCVE-2026-9322 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.
- Product
- WebSphere Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remCVE-2026-10842 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.
- Product
- WebSphere Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization.CVE-2026-6540 · Other software · Tigera · reported by psirt@tigera.ioHigh 7.9
Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.
- Product
- Calico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF aCVE-2026-14980 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.3
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request.CVE-2026-11897 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administratCVE-2026-11707 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.3
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page.
- Product
- Tivoli System Automation Application Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console.CVE-2026-11383 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console.
- Product
- Tivoli System Automation Application Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.CVE-2026-18362 · Other software · dfir-iris · reported by 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4aMedium 5.9
The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.
- Product
- iris-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.CVE-2026-18361 · Other software · dfir-iris · reported by 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4aHigh 7.6
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.
- Product
- iris-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.CVE-2026-18360 · Other software · dfir-iris · reported by 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4aHigh 7.6
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.
- Product
- iris-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.CVE-2026-16971 · Other software · dfir-iris · reported by 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4aMedium 5.9
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.
- Product
- iris-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective.CVE-2026-16970 · Other software · dfir-iris · reported by 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4aMedium 4.2
The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.
- Product
- iris-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Jul 30, 2026The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.CVE-2026-16969 · Other software · dfir-iris · reported by 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4aHigh 7.6
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.
- Product
- iris-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resultinCVE-2026-44106 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 8.5
A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
- Product
- CHARX SEC-3150
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, reCVE-2026-44093 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 8.5
A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
- Product
- CHARX SEC-3150
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT.CVE-2026-44092 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 8.8
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.
- Product
- CHARX SEC-3150
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot DashCVE-2026-47882 · Other software · Spring · reported by security@vmware.comHigh 8.3
When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier
- Product
- Spring Tools for Eclipse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote cCVE-2026-47858 · Other software · Spring · reported by security@vmware.comHigh 8
Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier
- Product
- Spring Tools for Eclipse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Pydantic AI is a Python agent framework for building applications and workflows with Generative AI.CVE-2026-65975 · Other software · pydantic · reported by GitHubMedium 6.5
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not including 2.5.0, the UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) use sanitize_messages to strip unresolved ("dangling") client-submitted tool calls from untrusted message history before it reaches the agent, a defense-in-depth default that prevents the agent from executing tool calls the model never emitted. However, the strip anchored to a message index computed before sanitization ran, so when a trailing client message sanitized to empty and was dropped (for example a client system message under the default manage_system_prompt='server'), a preceding assistant response carrying an unresolved tool call became the new tail and was dispatched without inspection. As a result, a remote client could cause a registered, non-approval server tool to run with client-supplied arguments rather than arguments the model produced. The impact is bounded by what the affected tools do and is most significant for applications that gate tool execution in a model-request hook (before
- Product
- pydantic-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Pydantic AI is a Python agent framework for building Generative AI applications.CVE-2026-54249 · Other software · pydantic · reported by GitHubMedium 6.8
Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter (such as the Vercel AI adapter) can reference arbitrary files in the application's model-provider or cloud-storage account. While file URL parts are validated against a scheme allowlist, UploadedFile references — which point to a file by provider file ID or cloud-storage URI (e.g. s3://…, gs://…) — were forwarded without validation. Because the provider resolves an UploadedFile using the server-side identity (IAM role, service account, or provider API key) rather than the client's, an attacker can craft message history to make the server read objects from its own account or other tenants, given a referenceable identifier. Exploitation requires a valid file identifier, which is not always unguessable depending on how the application names objects. This issue has been fixed in versions 1.106.0 and 2.0.0b6.
- Product
- pydantic-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Pydantic AI is a Python agent framework for building Generative AI applications.CVE-2026-46678 · Other software · pydantic · reported by GitHubMedium 6.8
Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into force_download='allow-local' (disabling the default block on private/internal IPs), the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form (IPv4-mapped IPv6, 6to4, or NAT64), exposing cloud IAM short-term credentials on dual-stack or translated networks. This is an incomplete fix of GHSA-2jrp-274c-jhv3 / CVE-2026-25580, whose remediation did not hold for IPv6-encoded forms of the metadata IPs. An application is affected only if it explicitly opts a FileUrl (ImageUrl, AudioUrl, VideoUrl, DocumentUrl) into force_download='allow-local' on a URL influenced by untrusted input; it is not affected when using bundled integrations to ingest user input (Agent.to_web / clai web, VercelAIAdapter, AGUIAdapter / Agent.to_ag_ui), since they do not propagate force_download from external data, nor when downloading only from developer-controlled URLs. This issue has been fixed in version 1.99.0.
- Product
- pydantic-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.