Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
912 results · page 3 of 19
Jun 17, 2026Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars).CVE-2026-35309 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.8
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Coherence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars).CVE-2026-35308 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 10
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
- Product
- Oracle Coherence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars).CVE-2026-35306 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.3
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data as well as unauthorized update, insert or delete access to some of Oracle Coherence accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
- Product
- Oracle Coherence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars).CVE-2026-35305 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.3
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data as well as unauthorized update, insert or delete access to some of Oracle Coherence accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
- Product
- Oracle Coherence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances.CVE-2026-48518 · Other software · juice-shop · reported by GitHubMedium 4.3
MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances. In versions 8.0.0 through 10.0.0, the team join endpoint (POST /multi-juicer/api/teams/{team}/join) accepted requests with any Content-Type, including text/plain. Because that content type does not trigger a CORS preflight, an attacker could host a cross-site HTML form that auto-submits to the endpoint and forces a victim's browser to log in as the attacker's team. A successful, undetected attacker can cause victims to unwittingly solve Juice Shop challenges under the attacker's team identity. In a CTF context this lets the attacker inflate their team's score using other players' activity, and any sensitive data the victim enters into "their" Juice Shop ends up in the attacker's instance. The vulnerability is exploitable without any prior authentication; the victim only needs to visit a page the attacker controls while having network access to the MultiJuicer deployment. SameSite=Strict on the session cookie does not mitigate this, because the attack plants a new cookie rather than relying on an existing one. This issue was fixed in version 10.0.1.
- Product
- multi-juicer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications.CVE-2026-53661 · Other software · malach-it · reported by GitHubHigh 8.8
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.9.1, boruta session cookies and the identity “remember me” cookie were set without the Secure attribute. In deployments where users could reach the same Boruta origin over plaintext HTTP, browsers could send these cookies over an unencrypted connection. An attacker able to observe or intercept that network traffic could recover a valid session or remember-me cookie and reuse it to impersonate the affected user. Affected components include boruta_web, boruta_identity, and boruta_admin. The affected cookies include the shared session cookie, defaulting to _boruta_web_key, and the identity remember-me cookie, defaulting to `_boruta_identity_web_user_remember_me`. The issue is fixed in commit 18691c655164635066aa113003a3cd87f6ed11cd, released as part of version 0.9.1. The patch sets `secure: true` and `same_site: "Lax"` on configured session cookies for boruta_web, boruta_identity, and boruta_admin, and sets `secure: true` on the identity remember-me cookie. Until upgrading to a release containing the fix: terminate or reject pl
- Product
- boruta-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service.CVE-2026-24065 · Other software · Waves Audio Ltd. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.1
Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. The helper validates connecting XPC clients using the client process identifier (PID) to verify code-signing identity. Because process identifiers can be reused, a local attacker can exploit a race condition between the time a connection request is made and the time the helper performs validation, causing the helper to trust an attacker-controlled process. This allows the attacker to invoke privileged operations, resulting in arbitrary code execution as root. The issue is fixed in version 16.6.2.
- Product
- Waves Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comsec-consult.com
Jun 9, 2026Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability.CVE-2026-24064 · Other software · Waves Audio Ltd. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.8
Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the product is signed with hardened runtime entitlements that permit dynamic library injection. A local attacker can set the DYLD_INSERT_LIBRARIES environment variable to inject an attacker-controlled dynamic library into the trusted client process at launch. The injected code runs within the signed process and can connect to the product's privileged helper service to invoke privileged operations, resulting in arbitrary code execution as root. The issue is fixed in version 16.6.2.
- Product
- Waves Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comr.sec-consult.com
May 27, 2026OpenLearnX is an open-source, decentralized learning and assessment platform.CVE-2026-44720 · Other software · th30d4y · reported by GitHubMedium 6.9
OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditions. This vulnerability is fixed in 2.0.4.
- Product
- OpenLearnX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026STER uses unencrypted TCP traffic to transmit data over the network.CVE-2026-25608 · Other software · Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy · reported by cvd@cert.plLow 2.3
STER uses unencrypted TCP traffic to transmit data over the network. It allows an attacker to conduct a Man-In-The-Middle attack and obtain sensitive data such as passwords, personal data, or authentication tokens. This issue was fixed in version 9.5.
- Product
- STER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords with known values are enCVE-2026-25607 · Other software · Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy · reported by cvd@cert.plMedium 5.7
Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords with known values are encoded. This issue was fixed in version 9.5.
- Product
- STER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026A SQL injection vulnerability has been identified in STER.CVE-2026-25606 · Other software · Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy · reported by cvd@cert.plHigh 8.7
A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters allows for SQL Injection attacks. It allows an authenticated attacker to view sensitive data such as data belonging to other users, or any other data that the application itself is able to access This issue was fixed in version 9.5.
- Product
- STER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026ShellHub is a centralized SSH gateway.CVE-2026-44426 · Other software · shellhub-io · reported by GitHubMedium 6.5
ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/namespaces/:tenant returns the full namespace object — including the members list (user IDs, e-mails, roles), settings, and device counts — to any caller authenticated by an API Key, for any tenant, regardless of the API Key's own tenant scope. The handler conditionally skips the membership check when the user ID (X-ID) is absent, which is exactly the case for API Key authentication. This vulnerability is fixed in 0.24.2.
- Product
- shellhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026ShellHub is a centralized SSH gateway.CVE-2026-44425 · Other software · shellhub-io · reported by GitHubMedium 5.4
ShellHub is a centralized SSH gateway. Prior to 0.24.2, the device list endpoint accepts user-controlled identifiers in the the name field of each filter property in the base64-encoded filter query parameter and the sort_by query parameter, which are then passed directly as BSON/SQL keys in the database layer without validation. Any authenticated user can craft payloads that cause the aggregation / query to fail and the API to return HTTP 500 with no body, with no rate limiting applied. This vulnerability is fixed in 0.24.2.
- Product
- shellhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026ShellHub is a centralized SSH gateway.CVE-2026-44424 · Other software · shellhub-io · reported by GitHubMedium 6.5
ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/devices/:uid returns the full device object whenever the caller is authenticated, without verifying that the device belongs to the caller's namespace (tenant). Any authenticated user (JWT or API Key) who knows or can guess a device UID can read device metadata from any other namespace. This vulnerability is fixed in 0.24.2.
- Product
- shellhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026ShellHub is a centralized SSH gateway.CVE-2026-44423 · Other software · shellhub-io · reported by GitHubMedium 6.5
ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/sessions/:uid returns the full session object for any authenticated caller, without scoping by the caller's tenant. An authenticated user can read session records (SSH username, device UID, remote IP, terminal type, authenticated flag, timestamps) belonging to any other namespace. This vulnerability is fixed in 0.24.2.
- Product
- shellhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.CVE-2026-40417 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft Dynamics 365 Business Central 2024 Release Wave 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2026Signal K Server is a server application that runs on a central hub in a boat.CVE-2026-41893 · Other software · SignalK · reported by GitHubHigh 8.7
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) are protected by express-rate-limit (default: 100 attempts per 10-minute window, configurable via HTTP_RATE_LIMITS). The WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting. An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). This issue has been patched in version 2.25.0.
- Product
- signalk-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2026There is an Access Control Vulnerability in some HikCentral Professional versions.CVE-2026-1749 · Network & remote access · Hikvision · reported by hsrc@hikvision.comMedium 6.8
There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission.
- Product
- HikCentral Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026OpenLearnX is an open-source, decentralized learning and assessment platform.CVE-2026-41900 · Other software · th30d4y · reported by GitHubHigh 8.8
OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.
- Product
- OpenLearnX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central.CVE-2026-5944 · Other software · Nutanix · reported by 2ffdacf6-8681-47df-b023-4f11abd61c1dMedium 6.7
An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an API passthrough endpoint on TCP port 7373 that is accessible within the network scope of the deployment environment without authentication. An unauthenticated attacker with network access can exploit this vulnerability by sending crafted requests to the exposed endpoint to enumerate cluster metadata, including virtual machine information and cluster configuration details. While the API primarily supports read-only operations, it also allows certain cluster maintenance workflows to be invoked. Although this vulnerability does not allow persistent modification of system configurations or access to credentials or sensitive user data, successful exploitation may result in disruption of active workloads, leading to loss of service availability within the affected environment.
- Product
- Cisco Intersight Device Connector for Prism Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.nutanix.comportal.nutanix.com
Apr 26, 2026P10 Central Management Software 1.4.13 contains a buffer overflow vulnerability in the login password field that allows local attackers to crash the applicationCVE-2018-25296 · Other software · P10 · reported by VulnCheckMedium 6.8
P10 Central Management Software 1.4.13 contains a buffer overflow vulnerability in the login password field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 2000-byte payload into the password field and click login to trigger an application crash and denial of service.
- Product
- Central Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordambientweather.comexploit-db.com
Apr 24, 2026Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a network.CVE-2026-21515 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a network.
- Product
- Azure IOT Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026Signal K Server is a server application that runs on a central hub in a boat.CVE-2026-39320 · Other software · SignalK · reported by GitHubHigh 7.5
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix.
- Product
- signalk-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows attackers to consume excessive amounts of disk space via network inteCVE-2024-33618 · Other software · Bosch · reported by psirt@bosch.comHigh 7.5
Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows attackers to consume excessive amounts of disk space via network interface.
- Product
- BVMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS) allows an attacker to modify the server's configuration file,CVE-2026-5756 · Other software · Data Recognition Corporation · reported by cret@cert.orgHigh 7.5
Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS) allows an attacker to modify the server's configuration file, potentially leading to mass data exfiltration, malicious traffic interception, or disruption of testing services.
- Product
- Central Office Services - Content Hosting Component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatarecognitioncorp.comkb.cert.org
Apr 9, 2026A Missing Authentication for Critical Function vulnerability in the Flexible PIC Concentrators (FPCs) of Juniper Networks Junos OS Evolved on PTX Series allows CVE-2026-33788 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 8.5
A Missing Authentication for Critical Function vulnerability in the Flexible PIC Concentrators (FPCs) of Juniper Networks Junos OS Evolved on PTX Series allows a local, authenticated attacker with low privileges to gain direct access to FPCs installed in the device. A local user with low privileges can gain direct access to the installed FPCs as a high privileged user, which can potentially lead to a full compromise of the affected component. This issue affects Junos OS Evolved on PTX10004, PTX10008, PTX100016, with JNP10K-LC1201 or JNP10K-LC1202: * All versions before 21.2R3-S8-EVO, * 21.4-EVO versions before 21.4R3-S7-EVO, * 22.2-EVO versions before 22.2R3-S4-EVO, * 22.3-EVO versions before 22.3R3-S3-EVO, * 22.4-EVO versions before 22.4R3-S2-EVO, * 23.2-EVO versions before 23.2R2-EVO.
- Product
- Junos OS Evolved
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows ResourceCVE-2026-39937 · Other software · The Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccHigh 8.8
Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure. The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.
- Product
- Mediawiki - CentralAuth Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Apr 2, 2026Signal K Server is a server application that runs on a central hub in a boat.CVE-2026-35038 · Other software · SignalK · reported by GitHubLow 2.1
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via `from` field bypass. This vulnerability allows a low-privileged authenticated user to bypass prototype boundary filtering to extract internal functions and properties from the global prototype object this violates data isolation and lets a user read more than they should. This issue has been patched in version 2.24.0.
- Product
- signalk-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Signal K Server is a server application that runs on a central hub in a boat.CVE-2026-34083 · Other software · SignalK · reported by GitHubMedium 6.1
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, SignalK Server contains a code-level vulnerability in its OIDC login and logout handlers where the unvalidated HTTP Host header is used to construct the OAuth2 redirect_uri. Because the redirectUri configuration is silently unset by default, an attacker can spoof the Host header to steal OAuth authorization codes and hijack user sessions in realistic deployments as The OIDC provider will then send the authorization code to whatever domain was injected. This issue has been patched in version 2.24.0.
- Product
- signalk-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Signal K Server is a server application that runs on a central hub in a boat.CVE-2026-33951 · Other software · SignalK · reported by GitHubMedium 6.9
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT /signalk/v1/api/sourcePriorities, does not enforce authentication or authorization checks and directly assigns user-controlled input to the server configuration. As a result, attackers can influence which GPS, AIS, or other sensor data sources are trusted by the system. The changes are immediately applied and persisted to disk, allowing the manipulation to survive server restarts. This issue has been patched in version 2.24.0-beta.1.
- Product
- signalk-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Signal K Server is a server application that runs on a central hub in a boat.CVE-2026-33950 · Other software · SignalK · reported by GitHubCritical 9.4
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection via /enableSecurity. An unauthenticated attacker can gain full Administrator access to the SignalK server at any time, allowing them to modify sensitive vessel routing data, alter server configurations, and access restricted endpoints. This issue has been patched in version 2.24.0-beta.4.
- Product
- signalk-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), SICORE Base system (All versions < V26.10.0).CVE-2026-27664 · Other software · Siemens · reported by productcert@siemens.comHigh 8.7
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), SICORE Base system (All versions < V26.10.0). The affected application contains an out-of-bounds write vulnerability while parsing specially crafted XML inputs. This could allow an unauthenticated attacker to exploit this issue by sending a malicious XML request, which may cause the service to crash, resulting in a denial-of-service condition.
- Product
- CPCI85 Central Processing/Communication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comseclists.org
Mar 26, 2026A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), RTUM85 RTU Base (All versions < V26.10).CVE-2026-27663 · Other software · Siemens · reported by productcert@siemens.comHigh 7.1
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), RTUM85 RTU Base (All versions < V26.10). The affected application contains denial-of-service (DoS) vulnerability. The remote operation mode is susceptible to a resource exhaustion condition when subjected to a high volume of requests. Sending multiple requests can exhaust resources, preventing parameterization and requiring a reset or reboot to restore functionality.
- Product
- CPCI85 Central Processing/Communication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comseclists.org
Feb 27, 2026Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects CentreonCVE-2026-2750 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7Critical 9.1
Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10; 24.10;24.04.
- Product
- Centreon Open Tickets on Central Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central SeCVE-2026-2749 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7Critical 9.9
Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10.3, 24.10.8, 24.04.7.
- Product
- Open Tickets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Blind SQL Injection via unsanitized array keys in Service Dependencies deletion.CVE-2026-2751 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7High 8.3
Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central Server before 25.10.8, 24.10.20, 24.04.24.
- Product
- Centreon Web on Central Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A path traversal vulnerability has been reported to affect Qsync Central.CVE-2025-68406 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 1.3
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-58472 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 1.2
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central.CVE-2025-58471 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 1.2
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.2.0.1 ( 2025/12/21 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A path traversal vulnerability has been reported to affect Qsync Central.CVE-2025-58470 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 1.3
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A relative path traversal vulnerability has been reported to affect Qsync Central.CVE-2025-58467 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 1.3
A relative path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central.CVE-2025-57711 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.6
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central.CVE-2025-57710 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.6
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A buffer overflow vulnerability has been reported to affect Qsync Central.CVE-2025-57709 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 1.3
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central.CVE-2025-57708 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2.3
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026An out-of-bounds read vulnerability has been reported to affect Qsync Central.CVE-2025-54170 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.9
An out-of-bounds read vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A use of out-of-range pointer offset vulnerability has been reported to affect Qsync Central.CVE-2025-54152 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 1.3
A use of out-of-range pointer offset vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read sensitive portions of memory. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central.CVE-2025-54151 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.9
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central.CVE-2025-54150 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.9
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.