Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,286 results · page 3 of 66
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105854 · Other software · payloadcms · reported by GitHubHigh 8.7
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105853 · Other software · payloadcms · reported by GitHubHigh 7.1
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot access. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105852 · Other software · payloadcms · reported by GitHubMedium 6.9
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where constraints. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105851 · Other software · payloadcms · reported by GitHubCritical 9.3
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105850 · Other software · payloadcms · reported by GitHubHigh 8.8
Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105849 · Other software · payloadcms · reported by GitHubHigh 7.7
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105848 · Other software · payloadcms · reported by GitHubMedium 6.4
Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105847 · Other software · payloadcms · reported by GitHubHigh 7.1
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset tokens, through polymorphic join filters. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105846 · Other software · payloadcms · reported by GitHubMedium 6.1
Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105845 · Other software · payloadcms · reported by GitHubCritical 9.8
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105844 · Other software · payloadcms · reported by GitHubCritical 9.3
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105806 · Other software · payloadcms · reported by GitHubHigh 8.6
Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version 3.88.0.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105805 · Other software · payloadcms · reported by GitHubMedium 6.9
Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information about field values the user cannot read. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Payload is a free and open source headless content management system.CVE-2026-105804 · Other software · payloadcms · reported by GitHubMedium 5.7
Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test recovered password hashes. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105683 · Other software · TryGhost · reported by GitHubLow 3.8
Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105682 · Other software · TryGhost · reported by GitHubLow 2.7
Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105681 · Other software · TryGhost · reported by GitHubMedium 6.5
Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105680 · Other software · TryGhost · reported by GitHubMedium 6.5
Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105679 · Other software · TryGhost · reported by GitHubHigh 7.3
Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a content type derived from their file extension. This could be used to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105678 · Other software · TryGhost · reported by GitHubMedium 4.3
Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105677 · Other software · TryGhost · reported by GitHubHigh 7.2
Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105676 · Other software · TryGhost · reported by GitHubMedium 4.9
Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105675 · Other software · TryGhost · reported by GitHubHigh 7.5
Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105652 · Other software · TryGhost · reported by GitHubLow 3.1
Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105651 · Other software · TryGhost · reported by GitHubHigh 7.3
Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105650 · Other software · TryGhost · reported by GitHubHigh 8.1
Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105649 · Other software · TryGhost · reported by GitHubHigh 7.3
Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.65.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105648 · Other software · TryGhost · reported by GitHubMedium 4
Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105647 · Other software · TryGhost · reported by GitHubMedium 4
Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105646 · Other software · TryGhost · reported by GitHubMedium 4.9
Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105645 · Other software · TryGhost · reported by GitHubMedium 4.9
Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105644 · Other software · TryGhost · reported by GitHubMedium 6.8
Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. This issue is fixed in version 6.67.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105643 · Other software · TryGhost · reported by GitHubHigh 7.3
Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, potentially compromising that user’s admin session. Self-hosted sites should leave the new security.embedPreviewUrl configuration option at its default value. This issue is fixed in version 6.67.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105642 · Other software · TryGhost · reported by GitHubHigh 8.8
Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server. This issue is fixed in version 6.67.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Kunstmaan CMS is an open source content management system based on the Symfony framework.CVE-2026-104890 · Other software · Kunstmaan · reported by GitHubHigh 7.2
Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An authenticated backend user with media access can upload a mixed-case executable extension such as PHP that bypasses the check and is stored in the web-accessible media directory with an executable lowercase extension. The default blacklist also omits several server-executable extension types, allowing the same code-execution impact where the web server executes uploaded files. This issue is fixed in version 7.3.2.
- Product
- KunstmaanBundlesCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0.CVE-2026-104625 · Other software · CodeAstro · reported by VulDBLow 2.1
A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument g_name results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
- Product
- Simple Loan Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Oct 2, 2026A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0.CVE-2026-104614 · Other software · CodeAstro · reported by VulDBLow 2.1
A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /SimplePharmacy-PHP/product/delete.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
- Product
- Simple Pharmacy Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Oct 2, 2026A vulnerability was determined in CodeAstro Simple Pharmacy Management System 1.0.CVE-2026-104613 · Other software · CodeAstro · reported by VulDBLow 2.1
A vulnerability was determined in CodeAstro Simple Pharmacy Management System 1.0. This vulnerability affects unknown code of the file /SimplePharmacy-PHP/product/view.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Simple Pharmacy Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Oct 2, 2026Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc.CVE-2026-85209 · Other software · AVEZ Electronics Communication Training and Consultancy Trade Inc. · reported by iletisim@usom.gov.trMedium 6.5
Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System (LMS): through 2026-09-18.
- Product
- Learning Management System (LMS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-71542 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 8.7
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting (XSS) in the "Theme to Components" functionality (admin/components.php) via the title parameter. The stored title is rendered inside a double-quoted HTML attribute in the administrative interface through an output path that HTML-entity-decodes the value before printing it, without re-encoding for the attribute context. This allows persistent execution of arbitrary JavaScript in the admin panel. At time of publication, there are no publicly available patches.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-71426 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 7.1
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is passed unsanitized to a PHP include() when the page is rendered. Because the include path is never confined, this allows directory-traversal Local File Inclusion: arbitrary local files are included (and, if they contain PHP, executed) when any visitor requests the page. At time of publication, there are no publicly available patches.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-70650 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 8.8
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting (XSS) vulnerability exists in the page backup viewer (admin/backup-edit.php). Page fields are correctly HTML-encoded when a page is saved, but the backup viewer decodes them again (htmldecode() / strip_decode()) and prints the result without re-escaping. A user who can edit a page can store JavaScript in a page's Keywords, Description, Menu text or Content; it executes in the browser of any administrator who later views that page's backup, in the context of the admin control panel. At time of publication, there are no publicly available patches.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-56662 · Other software · GetSimpleCMS-CE · reported by GitHubCritical 9.6
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that auto-submits a forged POST to the update endpoint; when an authenticated administrator visits it, the server performs an attacker-directed download-and-deploy operation in the administrator's session — with no further interaction. Because the deployed content is executed (see the related ZIP-extraction advisory), this yields remote code execution. The url field is additionally written into the form unescaped, providing a secondary HTML-injection sink via a malicious upgrade.json. This issue has been patched in version 1.5.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-56661 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 7.5
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with file_get_contents() after only format validation (FILTER_VALIDATE_URL) — there is no validation of the request destination. An attacker who can submit the form can make the server issue requests to arbitrary destinations, including internal-only services and cloud metadata endpoints (169.254.169.254). The fetched response body is written to a web-accessible file (/Tmpfile.zip) and is not deleted when the content is not a valid ZIP, turning this into a full-read SSRF: the attacker can retrieve the response of the internal request directly. This issue has been patched in version 1.5.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-56660 · Other software · GetSimpleCMS-CE · reported by GitHubCritical 9.1
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to be processed achieves remote code execution as the web-server user. Entry names are also used unsafely, allowing directory traversal (../) to write files outside the intended extraction directory. This issue has been patched in version 1.5.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-53953 · Other software · GetSimpleCMS-CE · reported by GitHubCritical 9.1
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary password and immediately stores its hash as the user's new password. The temporary password is generated using PHP rand() seeded with microtime(). Because this seed is time-based and has a limited effective search space, an attacker can generate possible reset password candidates. Since the admin login endpoint does not enforce rate limiting or account lockout, these candidates can be tested online until the correct password is found. Successful exploitation may lead to administrator account takeover. At time of publication, there are no publicly available patches.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal managemeCVE-2026-55224 · Other software · mineadmin · reported by GitHubHigh 8.7
MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences (e.g., ../) to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands. This issue has been patched in version 3.2.0-alpha.2.
- Product
- MineAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc.CVE-2026-85134 · Other software · Bimser Solution Software Trade Inc. · reported by iletisim@usom.gov.trHigh 8.8
Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Upload a Web Shell to a Web Server. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.11.
- Product
- eBA Plus Document and Workflow Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bimser Solution Software Trade Inc.CVE-2026-82969 · Other software · Bimser Solution Software Trade Inc. · reported by iletisim@usom.gov.trMedium 5.4
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Stored XSS. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.11.
- Product
- eBA Plus Document and Workflow Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bimser Solution Software Trade Inc.CVE-2026-82915 · Other software · Bimser Solution Software Trade Inc. · reported by iletisim@usom.gov.trMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Path Traversal. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.11.
- Product
- eBA Plus Document and Workflow Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.