Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,594 results · page 3 of 392
Oct 5, 2026DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product.CVE-2026-104811 · Email & office · Mitel · reported by vulnerability@ncsc.chHigh 8.4
DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality of the web portal listening on TCP port 443. The application is intended to allow users to upload WAV audio files but fails to properly validate the uploaded file type. An attacker can exploit this behavior to upload a malicious shared object (.so) instead of a WAV file. When the uploaded file is subsequently processed by the affected component, attacker-controlled code is loaded and executed in the context of the affected process. This can result in remote code execution and potentially full compromise of the underlying Linux system.
- Product
- Mitel MiVoice Office 400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimCVE-2026-104809 · Email & office · Mitel · reported by vulnerability@ncsc.chHigh 8.4
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A malicious shared object using the expected name can therefore be loaded by a privileged process. The module code then executes within the context and privileges of that process. This results in arbitrary code execution and full compromise of the Mitel Linux virtual machine.
- Product
- Mitel MiVoice Office 400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTCVE-2026-104808 · Email & office · Mitel · reported by vulnerability@ncsc.chLow 1.9
DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web application. The specific flaw exists within the web portal listening on TCP port 443, under Configuration → Users → Users List. The vulnerability occurs in the “Microsoft Exchange mailbox” field, which fails to properly validate or sanitize user-supplied input before storing and rendering it. By injecting malicious JavaScript into this field, an attacker can cause the payload to execute whenever the affected user properties are accessed. This can prevent access to the affected user properties and result in a denial-of-service condition within the application's user-management functionality.
- Product
- Mitel MiVoice Office 400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTCVE-2026-104807 · Email & office · Mitel · reported by vulnerability@ncsc.chLow 1.9
DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application. The specific flaw exists within the web portal listening on TCP port 443, under Configuration → Domains, specifically in the “Description” field. The application fails to properly validate or sanitize user-supplied input before storing and subsequently rendering the field. By injecting malicious JavaScript into the Description field, an attacker can modify the content and behavior of the affected page when it is viewed by other users. This could allow an attacker to alter the page's appearance, display attacker-controlled content, or construct convincing phishing scenarios within the application's trusted web context.
- Product
- Mitel MiVoice Office 400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory.CVE-2026-104806 · Email & office · Mitel · reported by vulnerability@ncsc.chMedium 5.5
DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to properly validate user-supplied file paths, allowing an attacker to manipulate the requested path and traverse the underlying directory structure. By exploiting this vulnerability, an attacker can access and download files located outside the intended system logs directory, including potentially sensitive system and application files.
- Product
- Mitel MiVoice Office 400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to CVE-2026-104805 · Email & office · Mitel · reported by vulnerability@ncsc.chHigh 8.5
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specific flaw exists within the backup restoration mechanism, which fails to properly validate the paths, file types, integrity, and authenticity of files contained within a restored TGZ archive. The application does not perform file-signature verification before extracting the archive, allowing a specially crafted backup to contain attacker-controlled files. An attacker with access to the backup SFTP or other configured repository can therefore provide a malicious TGZ archive that, when restored by the system, may place arbitrary files on the underlying Linux system. Depending on the location and permissions of the extracted files, this behavior can potentially be leveraged to achieve arbitrary code execution with root privileges and compromise the underlying virtual machine. The absence of enforced backup passwords further reduces the protection provided by the backup mechanism and may facilitate unauthorized access to the repository.
- Product
- Mitel MiVoice Office 400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443 via menus ACVE-2026-104706 · Email & office · Mitel · reported by vulnerability@ncsc.chHigh 8.4
DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443 via menus Administration -> View Logs
- Product
- Mitel MiVoice Office 400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A security flaw has been discovered in vgmstream up to r2117.CVE-2026-105248 · Other software · reported by VulDBMedium 5.3
A security flaw has been discovered in vgmstream up to r2117. This affects the function parse_params/txtp_parse of the file src/meta/txtp_parser.c of the component TXTP File Handler. The manipulation results in out-of-bounds write. The attack may be launched remotely. The patch is identified as 4669d37a6af94866f6f0628678f9f90d46954e8b. It is best practice to apply a patch to resolve this issue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1.CVE-2026-105226 · Websites & servers · osCommerce · reported by VulDBLow 2
A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file admin/newsletters.php of the component Newsletter Management. Performing a manipulation of the argument module results in code injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- osCommerce2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2026A security flaw has been discovered in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c.CVE-2026-105169 · Other software · kishor-23 · reported by VulDBMedium 5.5
A security flaw has been discovered in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This impacts an unknown function of the file delivery/delivery.php of the component Take Order Handler. The manipulation of the argument order_id/delivery_person_id results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- food-waste-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2026A security flaw has been discovered in mooSocial up to 3.2.4.CVE-2026-105149 · Other software · reported by VulDBMedium 5.5
A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. Performing a manipulation of the argument rating results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2026A security flaw has been discovered in topoteretes cognee up to 1.5.4.CVE-2026-105141 · Other software · topoteretes · reported by VulDBMedium 5.3
A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get_user_id_by_email of the file cognee/modules/users/authentication/get_api_auth_backend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPI_USERS_JWT_SECRET results in hard-coded credentials. The attack may be launched remotely. Upgrading to version 1.6.0 is sufficient to fix this issue. The patch is identified as fa65fc0cd86cdba48d19aa76e36be862be982f5d. Upgrading the affected component is advised.
- Product
- cognee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2026A security flaw has been discovered in Omega Solution CoinEx Crypto 2025.CVE-2026-105098 · Other software · Omega Solution · reported by VulDBLow 2.1
A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. Affected is an unknown function of the file /ticket/customer of the component Support Ticket API. The manipulation of the argument status/page/count results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CoinEx Crypto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token ofCVE-2026-103957 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.2
Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted discovery document address supplied when registering a tool server or remote agent configured for delegated authentication. To remediate this issue, users should upgrade to version 1.7.0 or later.
- Product
- loom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Oct 2, 2026A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0.CVE-2026-104625 · Other software · CodeAstro · reported by VulDBLow 2.1
A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument g_name results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
- Product
- Simple Loan Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Oct 1, 2026A security flaw has been discovered in calcom cal.diy up to 6.2.0.CVE-2026-104054 · Other software · calcom · reported by VulDBLow 2.1
A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
- Product
- cal.diy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding.CVE-2026-104056 · Other software · Authlib · reported by cret@cert.orgCritical 9.8
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.
- Product
- Authlib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorduziii2208.github.iouziii2208.github.io
Oct 1, 2026A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0.CVE-2026-103538 · Other software · ZongXR · reported by VulDBMedium 5.5
A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the argument orderId results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- SuperMarket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3.CVE-2026-103115 · Other software · OS4ED · reported by VulDBLow 2.1
A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- openSIS-Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to senCVE-2026-102511 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.5
Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address. The discovery result's connection address was derived from the AmsNetId claimed in the response body rather than from the datagram's actual source address. One spoofed discovery response can therefore insert an inventory entry pointing at any host, including hosts outside the local network, and an application that connects to discovered devices will open its ADS session, including any configured route credentials, to that host. Additionally, discovery listeners in both implementations can be disabled by a single malformed datagram: - In PLC4Go ADS discovery, a short version block causes a panic that ends the listener for the rest of the discovery call, so legitimate devices answering afterwards are not reported. - In PLC4J, the ADS and EtherNet/IP discoverers stop on an unhandled exception from a malformed response. - The PLC4J Modbus discoverer can be made to spin indefinitely, consuming a CPU core, by a sc
- Product
- Apache PLC4X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 29, 2026A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8.CVE-2026-102843 · Other software · gedelumbung · reported by VulDBLow 2
A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function hapus of the file application/modules/admin/controllers/data_galeri.php of the component Endpoint. Performing a manipulation of the argument gbr results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- HospitalManagement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component.CVE-2026-79536 · Other software · reported by MITRECritical 9.1
bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON.CVE-2026-76732 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.4
A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges if certain preconditions are met outside of the attacker's control.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message.CVE-2026-102720 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.3
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option walk keeps a pointer and an offset in step, and the only bound check uses the offset: ```c /* addons/dhcp/nxd_dhcp_client.c:7538, 7572 */ while (i < length - 1) { ... size = *(++data); /* data moves 1: type -> length byte */ data += size + 1; /* data moves size + 1 more */ i += size + 1; /* i moves only size + 1 */ } ``` A TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so the offset falls one byte behind the real read position for every option the walk skips. After enough skipped options the check `i < length - 1` still holds while `data` is already past the end of the message, and the subsequent read of the type and length bytes comes from whatever follows. A single OFFER carrying a long run of skippable options is enough: ``` ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1 at 0x61b000000794 thread T5 #0 _nx_dhcp_search_buffer addons/dhcp/nxd_dhcp_client.c:7
- Product
- eclipse-threadx/netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A security flaw has been discovered in REBUILD up to 4.4.11.CVE-2026-102249 · Other software · reported by VulDBMedium 5.5
A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argument url/fileKey results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A security flaw has been discovered in MODSetter SurfSense up to 0.0.36.CVE-2026-102244 · Other software · MODSetter · reported by VulDBLow 2.1
A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.0.36.3 is recommended to address this issue. The patch is named 2faff7b3823322a9cb6797973e6caf089386c354. The affected component should be upgraded.
- Product
- SurfSense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 28, 2026A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4.CVE-2026-101354 · Other software · FAST · reported by VulDBHigh 8.6
A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase Parser. Performing a manipulation results in stack-based buffer overflow. The attacker must have access to the local network to execute the attack. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- FAC1203R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0.CVE-2026-101277 · Other software · Trusted Domain Project · reported by VulDBMedium 5.5
A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkim_process_set of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OpenDKIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions fromCVE-2024-42002 · Other software · Open Source Robotics Foundation · reported by security@ubuntu.comHigh 8.6
A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.
- Product
- Robot Operating System 2 (ROS 2)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A security flaw has been discovered in Eleveo Quality Management 9.7.0.CVE-2026-101146 · Other software · Eleveo · reported by VulDBLow 2.1
A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService of the component GWT RPC Handler. Performing a manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Quality Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2.CVE-2026-101132 · Other software · DeepSeek · reported by VulDBLow 1.3
A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function loadProfile of the file packages/boot/app-boot/src/profile.ts of the component Bundle Patch Handler. The manipulation of the argument dsh.bundle.patch results in path traversal. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- deepseek-harness
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A security flaw has been discovered in D-Link DI-8400 16.07.CVE-2026-101081 · Network & remote access · D-Link · reported by VulDBHigh 8.5
A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menu_nat_more_asp of the file menu_nat_more.asp of the component Web Administration Service. The manipulation of the argument opt results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
- Product
- DI-8400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service).CVE-2026-93539 · Other software · SUSE · reported by meissner@suse.deMedium 5.4
A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside the namespaces they are authorized for. This only affects SUSE Rancher Fleet 0.16 before 0.16.2, older versions are not affected.
- Product
- Rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A cross-tenant authorization issue was discovered in SUSE Rancher Fleet.CVE-2026-93538 · Other software · SUSE · reported by meissner@suse.deHigh 7.1
A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster. This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.
- Product
- Rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A security flaw has been discovered in Netcore NR289-GE 1.4.5102.CVE-2026-101073 · Other software · Netcore · reported by VulDBMedium 5.5
A security flaw has been discovered in Netcore NR289-GE 1.4.5102. Impacted is an unknown function of the file /bin/boa of the component CGI Dispatcher. Performing a manipulation results in improper authentication. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NR289-GE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A security flaw has been discovered in dbgate up to 7.3.1.CVE-2026-101068 · Other software · reported by VulDBMedium 5.5
A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packages/api/src/utility/zipJsonLinesData.js of the component Create Connection Endpoint. Performing a manipulation of the argument filePath results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. PR #1530 / commit 5f99b4d82 (7.2.5) hardened other export endpoints with checkSecureExportFilePath but omitted this endpoint. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A security flaw has been discovered in Thinkware U3000 up to 1.02.04.CVE-2026-101055 · Other software · Thinkware · reported by VulDBMedium 5.5
A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability is the function GET_STATUS of the component TCP Service. The manipulation of the argument wifi_info results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- U3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows.CVE-2026-19444 · Other software · Kubernetes · reported by jordan@liggitt.netMedium 6.5
A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container to build a tar archive, transfers it over the network, and unpacks it on the local machine. If the tar binary in the container is malicious, it can execute arbitrary code and emit unexpected output, allowing an attacker who controls container contents to write files to arbitrary paths on the user's local machine when kubectl cp is invoked, limited only by the system permissions of the local user. This issue only affects kubectl clients running on Windows.
- Product
- Kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF up to 20260813.CVE-2026-101040 · Other software · Ricoh · reported by VulDBMedium 5.7
A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF up to 20260813. This affects an unknown part of the component HTTP Multipart Form-Data Parser. Performing a manipulation results in denial of service. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SP 330DN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A security flaw has been discovered in aaPanel BaoTa up to 11.8.0.CVE-2026-101011 · Other software · aaPanel · reported by VulDBLow 2
A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function get_domain_status of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argument get results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BaoTa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 28, 2026A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246.CVE-2026-101002 · Other software · Netcore · reported by VulDBHigh 8.6
A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/network_tools of the component Tools Ping Handler. Performing a manipulation of the argument url results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NBR200V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2026A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1.CVE-2026-100895 · Other software · Trusted Domain Project · reported by VulDBMedium 5.5
A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1. Impacted is the function arc_parse_canon_t in the library libopenarc/arc-canon.c of the component libopenarc. The manipulation results in null pointer dereference. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.0.0.Beta0 is recommended to address this issue. Upgrading the affected component is advised.
- Product
- OpenARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2026A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95.CVE-2026-100887 · Other software · amirsanni · reported by VulDBLow 2.1
A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function order_by of the file DB_query_builder.php of the component Database Query Builder. Performing a manipulation of the argument orderBy results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project maintainer confirms: "I stopped maintaining that project for a while now, so I'm not sure it's worth fixing." This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Mini-Inventory-and-Sales-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 27, 2026A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1.CVE-2026-100879 · Other software · zhistaredu · reported by VulDBLow 2.1
A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- StarTraining
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2026A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be.CVE-2026-100312 · Other software · mathurvishal · reported by VulDBLow 2.1
A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file /updateguest.php. Performing a manipulation of the argument gname/editassid results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CloudClassroom-PHP-Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026A security flaw has been discovered in Krayin laravel-crm up to 2.2.5.CVE-2026-97897 · Other software · Krayin · reported by VulDBMedium 5.1
A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 is capable of addressing this issue. The patch is identified as 734aa10ae6c2ffa4c96c8869a89aa66940e4d345. You should upgrade the affected component.
- Product
- laravel-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1.CVE-2026-97879 · Other software · zhistaredu · reported by VulDBMedium 5.5
A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- StarTraining
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026A security flaw has been discovered in Open-Web-Analytics up to 1.8.1.CVE-2026-97865 · Other software · reported by VulDBMedium 6.9
A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The patch is named 78c1222ec0e2119d84684032da1541120a2cdd23. The affected component should be upgraded.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-CVE-2026-97984 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork->base.fragsize to IP6_MAX_MTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udp_set_len_short when setsockopt IPV6_MTU_DISCOVER is set to IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE, and a large packet is sent over a netdev with an unusually large MTU. Steps to reproduce (included in the new selftest): 1. Set device MTU bigger than IP6_MAX_MTU. cork->base.fragsize will be set to that MTU in ip6_setup_cork. 2. Set IPV6_MTU_DISCOVER to IPV6_PMTUDISC_PROBE or IPV6_PMTUDISC_DO. It lets maxnonfragsize be set to device MTU (cork->fragsize) in __ip6_append_data, rather than to IP6_MAX_MTU. 3. Send 65528 bytes of payload (+8 bytes of UDP header, +40 bytes of IPv6 header). Device MTU allows it (it's only one byte bigger than IP6_MAX_MTU, and the device MTU is bigger than that). 4. The UDP length in the built packet is 65536, which overflows the 16-bit length field and triggers the WARN in udp_set_len_short. To avoid breaking sending UDP jumbograms over raw IPv6 sockets, limit the
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 24, 2026A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0.CVE-2026-97366 · Other software · jhen0409 · reported by VulDBLow 2.1
A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- react-native-debugger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.