Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
330,644 results · page 3 of 6613
Nov 6, 2026FreeScout is a self-hosted help desk and shared mailbox.CVE-2026-62854 · Other software · freescout-help-desk · reported by GitHubHigh 7.6
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file uploaded through /uploads/upload with nested tag fragments that bypass Helper::stripDangerousTags(). The resulting external script is served from the same origin, so the script-src 'self' policy permits it when another user opens the affected mailbox reply editor or new-ticket page. The script executes with the victim's FreeScout privileges and can read visible data and perform same-origin actions. This issue is fixed in version 1.8.225.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026FreeScout is a self-hosted help desk and shared mailbox.CVE-2026-62852 · Other software · freescout-help-desk · reported by GitHubMedium 6.5
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction for users configured to see only assigned conversations. A restricted authenticated user can subscribe to predictable conv.<conversation_id> Polycast channels for other conversations in the same mailbox. New event payloads can expose complete replies, internal notes, recipient addresses, conversation state, assignee data, attachment names, and attachment URLs containing valid download tokens. This issue is fixed in version 1.8.226.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026FreeScout is a self-hosted help desk and shared mailbox.CVE-2026-62851 · Other software · freescout-help-desk · reported by GitHubMedium 4.3
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, the search-by-number shortcut in ConversationsController::search() resolves a user-controlled ticket number without applying the mailbox filter or view policy used by the normal search path. An authenticated non-admin agent who is a member of at least one mailbox can request /search with a hash-prefixed ticket number and use the 302 Location header to confirm that a conversation exists in a different mailbox the agent cannot access and learn its internal conversation and folder identifiers. The destination conversation remains protected, so this issue does not disclose message content, attachments, or customer data. This issue is fixed in version 1.8.226.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026FreeScout is a self-hosted help desk and shared mailbox.CVE-2026-62850 · Other software · freescout-help-desk · reported by GitHubMedium 5.3
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrative tools.php maintenance endpoint is reachable without an appropriate authentication or access-control boundary. Response differences for attacker-controlled path values disclose whether arbitrary directories and files exist on the server. The same endpoint validates application-key and database-password candidates without rate limiting, per-session throttling, or a CAPTCHA, allowing unrestricted guessing attempts against application secrets. This issue is fixed in version 1.8.225.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrarCVE-2026-49951 · Other software · infiniflow · reported by VulnCheckMedium 5.3
RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated base_url to the POST /v1/llm/set_api_key endpoint handled by set_api_key() in api/apps/llm_app.py. Attackers can exploit this flaw to probe shared-network services such as MySQL, Elasticsearch, Redis, MinIO, the Infinity vector database, and cloud metadata endpoints, with raw upstream exception text returned in the response leaking internal service details, open ports, and configuration fingerprints.
- Product
- ragflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys file to be a symlink.CVE-2026-123962 · Other software · Debian · reported by MITREHigh 8.4
In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys file to be a symlink. NOTE: FreedomBox is a Debian Pure Blend, which means that it distributes its software through Debian repositories.
- Product
- FreedomBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalioth-lists.debian.netfreedombox.org
Nov 6, 2026When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality in the Snowflake Connector for Python anCVE-2026-123859 · Other software · Snowflake · reported by 412d305a-227d-44f9-a262-a31ba44f2aeaHigh 8.1
When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python (Universal Core) did not escape DataFrame column names before including them in generated SQL, which could allow SQL injection. In both products, a crafted column name could have been used to chain additional SQL statements onto the generated statement, potentially allowing an attacker to read, modify, or delete other data accessible to the application's Snowflake role. Exploitation required an application to pass attacker controlled column names into this functionality. The fix is available in Snowflake Connector for Python version 4.8.1 and Snowflake Connector for Python (Universal Core) version 5.2.0. Users must upgrade manually.
- Product
- Snowflake Connector for Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.snowflake.comdocs.snowflake.com
Nov 6, 2026In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projectsCVE-2026-123858 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.4
In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects
- Product
- PhpStorm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetectionCVE-2026-123857 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection
- Product
- PhpStorm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development serverCVE-2026-123856 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server
- Product
- Toolbox App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget moduleCVE-2026-123854 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.5
In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module
- Product
- PyCharm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build processCVE-2026-123853 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updatesCVE-2026-123852 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.4
In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates
- Product
- Junie GitHub Action
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded charactersCVE-2026-123851 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters
- Product
- Junie GitHub Action
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File WatchersCVE-2026-123849 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificatesCVE-2026-123848 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.4
In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completionCVE-2026-123847 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validationCVE-2026-123846 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projectsCVE-2026-123845 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.3
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configurationCVE-2026-123843 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.3
In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archivesCVE-2026-123842 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.1
In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archiveCVE-2026-123841 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabsCVE-2026-123840 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.7
In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding modelCVE-2026-123839 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.7
In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backupCVE-2026-123836 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.8
In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race conditionCVE-2026-123835 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.9
In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service accountCVE-2026-123834 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projectsCVE-2026-123833 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.6
In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote useCVE-2026-122193 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Critical 9.3
OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement. To remediate this issue, users should delete any Rex-RO and Rex-RW SSM documents created from the example script, in each account and Region where it was run.
- Product
- trusted-remote-execution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Nov 6, 2026The Symfony Serializer component ObjectNormalizer treats any attribute name containing .CVE-2026-122053 · Other software · sensiolabs · reported by 596c5446-0ce5-4ba2-aa66-48b3b757a647Medium 6.9
The Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.4, [) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their #[Ignore] metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9 prior to 6.4.50, 7.0.9 prior to 7.1.0, 7.1.2 prior to 7.4.23, and 8.x prior to 8.1.11. ObjectNormalizer::isAllowedAttribute() accepts such names, and setAttributeValue() hands the name straight to PropertyAccessor::setValue(), which parses it as a property path and traverses into the nested object. A payload key such as customer.admin writes to $order->customer->admin. The #[Ignore] metadata attribute is only consulted when the nested object is denormalized in its own right, never when it is reached through a path. #[Groups] restrictions are not bypassed: the path is only accepted when no groups are passed in the context, and then groups restrict nothing. When the root class carries neither #[Ignore] nor #[Groups], no allowlist applies and every key of the payload is let through. Because PropertyAccessor also resolves a path segment against public methods, a segment matching a publi
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property typed with a subclass suCVE-2026-118515 · Other software · sensiolabs · reported by 596c5446-0ce5-4ba2-aa66-48b3b757a647High 8.4
The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, and File, so for a property typed with a subclass such as UploadedFile, ObjectNormalizer instantiates the object through its constructor from attacker-controlled data, including the file path. This allows an arbitrary file on the server to be treated as an uploaded file in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. A request body such as {"image": {"path": "/path/to/project/.env.local", "originalName": "a.png", "test": true}} makes the application handle any file on the server as an upload, without the file being sent. With test: true, UploadedFile::isValid() skips is_uploaded_file() and move() falls back to rename(). Assert\File does not prevent this because it validates the file at the attacker-chosen path, which exists on the server. Any code that deserializes untrusted data into a type that holds such a property is affected. That includes #[MapRequestPayload] on a DTO with an UploadedFile property, which is how uploads are mapped in Symfony 8.1; a single unauthenticated request with a JSON or form body is enough.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common) in Progress Software Kendo UI for Angular CVE-2026-106144 · Other software · Progress Software · reported by security@progress.comMedium 4.1
Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common) in Progress Software Kendo UI for Angular versions prior to 25.1.0 allows a high-privileged attacker who can control a field path processed by the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.
- Product
- Kendo UI for Angular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue versions 2.7.1 through 10.0.0 allows a lowCVE-2026-106143 · Other software · Progress Software · reported by security@progress.comMedium 5.4
Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue versions 2.7.1 through 10.0.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via an unsafe URL entered in the Insert Link or Insert Image dialog, which runs when the user clicks the resulting link.
- Product
- Kendo UI for Vue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-react-editor) in Progress Software KendoReact versions 2.7.0 through 16.1.0 allows a low-priCVE-2026-106142 · Other software · Progress Software · reported by security@progress.comMedium 5.4
Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-react-editor) in Progress Software KendoReact versions 2.7.0 through 16.1.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link with an unsafe URL in the Editor content, which runs when the user clicks the link.
- Product
- KendoReact
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-angular-editor) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a CVE-2026-106141 · Other software · Progress Software · reported by security@progress.comMedium 5.4
Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-angular-editor) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link or image with an unsafe URL in the Editor content, which runs when the user interacts with it.
- Product
- Kendo UI for Angular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui) in Progress Software KendoReact versions 0.6.0 through 16.1.0 allows CVE-2026-106136 · Other software · Progress Software · reported by security@progress.comMedium 5.4
Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui) in Progress Software KendoReact versions 0.6.0 through 16.1.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in the origin of the application via an unsafe URL in an openUrl quick action, which runs when a user clicks the action.
- Product
- KendoReact
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 CVE-2026-106135 · Other software · Progress Software · reported by security@progress.comMedium 5.4
Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an openUrl quick action, which runs when the user clicks the action.
- Product
- Kendo UI for Angular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReact versions 1.3.0 through 16.1.0 allows a low-priviCVE-2026-106134 · Other software · Progress Software · reported by security@progress.comMedium 5.4
Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReact versions 1.3.0 through 16.1.0 allows a low-privileged attacker who can influence the Menu item data to execute arbitrary JavaScript in the origin of the application via an unsafe URL in a Menu item, which runs when a user selects the item.
- Product
- KendoReact
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through 9.2.0 allows a high-privileged attacker who can cCVE-2026-106128 · Other software · Progress Software · reported by security@progress.comMedium 4.1
Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through 9.2.0 allows a high-privileged attacker who can control a field path processed by components such as the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.
- Product
- Kendo UI for Vue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Prototype Pollution in the setter utility (@progress/kendo-react-common) in Progress Software KendoReact versions 3.5.0 through 16.0.0 allows a high-privileged CVE-2026-106127 · Other software · Progress Software · reported by security@progress.comMedium 4.1
Prototype Pollution in the setter utility (@progress/kendo-react-common) in Progress Software KendoReact versions 3.5.0 through 16.0.0 allows a high-privileged attacker who can control a field path passed to the utility, directly or through components such as the Form, Scheduler, and Gantt, to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.
- Product
- KendoReact
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or CVE-2026-104657 · Other software · Progress Software · reported by security@progress.comHigh 7.5
Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.
- Product
- Fiddler Download & Setup Skill
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commandCVE-2026-104656 · Other software · Progress Software · reported by security@progress.comHigh 7.3
Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.
- Product
- Progress® Telerik® Fiddler® Everywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026FreeScout is a self-hosted help desk and shared mailbox.CVE-2026-103985 · Other software · freescout-help-desk · reported by GitHubHigh 7.1
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026FreeScout is a self-hosted help desk and shared mailbox.CVE-2026-103984 · Other software · freescout-help-desk · reported by GitHubMedium 6.5
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility is enabled, the load_customer_info AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox. A non-admin agent can name an accessible mailbox and retrieve an unrelated customer's rendered profile without invoking CustomerPolicy::view(). The response can expose names, email addresses, phone numbers, company and job information, postal addresses, social profiles, websites, and confidential internal agent notes. This issue is fixed in version 1.8.231.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation.CVE-2026-90436 · Websites & servers · Apache Software Foundation · reported by security@apache.org
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.
- Product
- Apache Axis 1.x (EOL)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Nov 6, 2026An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial of service by causing a system crash.CVE-2026-80303 · Other software · Gen Digital · reported by security@nortonlifelock.com
An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial of service by causing a system crash. The WFP callout driver processes network stream data and computes length values for packet fragment reassembly. The length calculation does not properly validate input stream sizes against expected boundaries. When processing specially crafted input, the length computation underflows, resulting in allocation or buffer access with an extremely large wrapped-around size value. The underflow can be triggered remotely via network traffic destined for the filtered port, or locally via crafted data provided to the filtering interface. The resulting memory allocation failure or out-of-bounds access causes a kernel panic and system crash.
- Product
- Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.avast.comsupport.avg.com
Nov 6, 2026Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged attacker executing inside the sandbox to write aCVE-2026-80302 · Other software · Gen Digital · reported by security@nortonlifelock.com
Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged attacker executing inside the sandbox to write arbitrary files outside sandbox containment and execute code on the host. The sandbox virtualizes file system operations by intercepting write requests to protected system directories. However, the virtualization implementation fails to properly validate write targets in certain edge cases, allowing writes to bypass the virtualization redirection and reach the actual host file system in protected locations. An attacker can exploit this to overwrite executable files, system libraries, or startup configurations with arbitrary content, leading to code execution with host privileges on subsequent system operations or reboot.
- Product
- Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.avast.comsupport.avg.com
Nov 6, 2026Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside the sandbox to access COM interfaces to the Task SchCVE-2026-80301 · Other software · Gen Digital · reported by security@nortonlifelock.com
Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside the sandbox to access COM interfaces to the Task Scheduler service, escape containment, and execute code with elevated privileges outside the sandbox. The sandbox virtualizes file system and registry access but does not adequately restrict COM interface access to Task Scheduler. A process inside the sandbox can instantiate COM objects bound to Task Scheduler functionality and invoke methods to schedule and execute tasks on the host system. The Task Scheduler COM pathway is not blocked by the sandbox policy, allowing arbitrary code execution in the host security context. This escape vector bypasses the sandbox's intended process and file isolation boundaries and can be chained with other host-level privilege escalation techniques.
- Product
- Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.avast.comsupport.avg.com
Nov 6, 2026HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed login attempts, allowing an attacker tCVE-2026-66987 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed login attempts, allowing an attacker to make a large number of password guesses against a user account. This may increase the risk of account compromise through brute-force attacks, potentially resulting in unintended behavior or security impact under certain conditions.
- Product
- HCL AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Nov 6, 2026HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity.CVE-2026-66986 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity. An unattended authenticated session could be used by another person with access to the same system to view information or perform actions on behalf of the user, potentially resulting in unintended behavior or security impact under certain conditions.
- Product
- HCL AION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.