Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,156 results · page 3 of 64
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 CVE-2026-39750 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.CVE-2026-39719 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Smart Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32574 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.
- Product
- Smart Forms
- Affected
- up to 2.6.104
- What to do
- Affects up to 2.6.104. Update Smart Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2026Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management: Generic SQL InjectionCVE-2026-18443 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This exploit is only possible on installations where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, as this condition allows the authorization filter to implicitly permit Subscriber-level users to invoke the vulnerable handler.
- Product
- Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management
- Affected
- up to 8.97.0
- What to do
- Affects up to 8.97.0. Update Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2026WPC Smart Quick View for WooCommerce: Reflected Cross-Site ScriptingCVE-2026-103888 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woosq-redirect' parameter in all versions up to, and including, 4.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The WooCommerce "redirect to cart after add to cart" option must be enabled for the filter that reads the woosq-redirect parameter to execute; however, the ?quick-view= auto-open mechanism means no further user interaction beyond loading the crafted URL is required to trigger script execution.
- Product
- WPC Smart Quick View for WooCommerce
- Affected
- up to 4.4.0
- What to do
- Affects up to 4.4.0. Update WPC Smart Quick View for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 2, 2026Smart One Click Setup – Complete Demo Import & Export: Insertion of Sensitive Information Into Sent DataCVE-2026-32584 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Click Setup – Complete Demo Import & Export: from n/a through 1.4.3.
- Product
- Smart One Click Setup – Complete Demo Import & Export
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Smart One Click Setup – Complete Demo Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc.CVE-2026-18783 · Other software · Trex Digital Smart Manufacturing Systems Inc. · reported by iletisim@usom.gov.trHigh 8.8
Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass. This issue affects Trex MES: through 2026-09-29.
- Product
- Trex MES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc.CVE-2026-18782 · Other software · Trex Digital Smart Manufacturing Systems Inc. · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.
- Product
- Trex MES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Smart Slider 3: Stored Cross-Site ScriptingCVE-2026-14876 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Smart Slider 3
- Affected
- up to 3.5.1.38
- What to do
- Affects up to 3.5.1.38. Update Smart Slider 3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 29, 2026Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictCVE-2026-95303 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 28, 2026mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption.CVE-2026-82936 · Other software · F&F Filipowski · reported by cvd@cert.plMedium 5.9
mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can send large request bodies that exhausts buffers in RAM, causing out-of-memory conditions and crashing the fh-node process, resulting in denial of service. The successful attack depends on the current memory usage of the device which is not under full control of the attacker. Critically, due to CVE-2026-82930 all endpoints can be queried unauthenticated, so any user on LAN can perform this attack. This issue was fixed in version 3.0.30
- Product
- mH-DEVELOPER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware.CVE-2026-82935 · Other software · F&F Filipowski · reported by cvd@cert.plMedium 6.9
mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit these known flaws to execute arbitrary code, access sensitive data, or cause a denial of service on the device. Vulnerable components were updated or hardened, if update was not possible in version 3.0.30
- Product
- mH-DEVELOPER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP.CVE-2026-82933 · Other software · F&F Filipowski · reported by cvd@cert.plMedium 6
mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This issue was fixed in version 3.0.30
- Product
- mH-DEVELOPER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026mH-DEVELOPER smart home module does not load any firewall rules at startup.CVE-2026-82932 · Other software · F&F Filipowski · reported by cvd@cert.plMedium 5.3
mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in version 3.0.30
- Product
- mH-DEVELOPER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authenticCVE-2026-82930 · Other software · F&F Filipowski · reported by cvd@cert.plMedium 6.4
mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to manipulate building automation devices. This issue was fixed in version 3.0.30
- Product
- mH-DEVELOPER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation.CVE-2026-82929 · Other software · F&F Filipowski · reported by cvd@cert.plMedium 6.3
mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential interception. This issue was fixed in version 3.0.30
- Product
- mH-DEVELOPER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor.CVE-2026-82928 · Other software · F&F Filipowski · reported by cvd@cert.plHigh 7.7
mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected device, resulting in full system compromise. The key cannot be removed without remounting the file system and survives a factory reset. Vendor notes that this functionality was used only for service purposes. This issue was fixed in version 3.0.30
- Product
- mH-DEVELOPER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.CVE-2026-100248 · Other software · Rattadan · reported by MITREHigh 8.4
The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.
- Product
- Cosmowarp Contract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who has the vulnerable fiCVE-2026-27867 · Other software · Teldat · reported by ffb98d57-deaa-4918-a669-5225ccc13e39Medium 4.8
An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who has the vulnerable firmware version could inject a specific payload via the parameter "cmdcookie" withing the /upgrade/index.html resulting in to a Cross-Site Scripting (XSS). This issue affects Regesta Smart HD-PLC - TLDPH16D2: 11.02.06.00.02
- Product
- Regesta Smart HD-PLC - TLDPH16D2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.teldat.comsupport.teldat.com
Sep 25, 2026Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a hard-coded cryptograCVE-2026-75553 · Other software · Tohoku Electric Power Company, Incorporated · reported by vultures@jpcert.or.jpLow 2.4
Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a hard-coded cryptographic key from the affected product.
- Product
- Tohoku Electric Power "Yorisou e Net" Android App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error Return the parseCVE-2026-97426 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error Return the parse error before acquiring PM access.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 23, 2026Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.CVE-2026-95530 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.
- Affected
- up to 11.4.1
- What to do
- Affects up to 11.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026WPC Smart Compare for WooCommerce: Does not apply WordPress's post-password protectionCVE-2026-90985 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products.
- Product
- WPC Smart Compare for WooCommerce
- Fixed in
- 6.6.1
- What to do
- Update WPC Smart Compare for WooCommerce to 6.6.1 or newer.
Sep 21, 2026luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound.CVE-2026-55159 · Other software · openwrt · reported by GitHubHigh 8.8
luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app-adblock-fast write ACL can therefore create an additional physical root cron entry through applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, resulting in persistent command execution as UID 0 when cron runs. The issue is not demonstrated for unauthenticated callers or users without the component write ACL. This vulnerability is fixed in 1.2.4-2.
- Product
- luci-app-adblock-fast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2026The ZTE SmartLife application has a hardcoded key.CVE-2026-86555 · Other software · ZTE · reported by psirt@zte.com.cnMedium 6.2
The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it.
- Product
- SmartLife
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2026SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process.CVE-2026-86554 · Other software · ZTE · reported by psirt@zte.com.cnMedium 4.3
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.
- Product
- SmartLife
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2026SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process.CVE-2026-86553 · Other software · ZTE · reported by psirt@zte.com.cnHigh 8.8
SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.
- Product
- SmartLife
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2026SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime.CVE-2026-86552 · Other software · ZTE · reported by psirt@zte.com.cnMedium 5.4
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.
- Product
- SmartLife
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2026WPGraphQL Smart Cache: Does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a requestCVE-2026-92099 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.
- Product
- WPGraphQL Smart Cache
- Fixed in
- 2.3.2
- What to do
- Update WPGraphQL Smart Cache to 2.3.2 or newer.
Sep 17, 2026The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, ratherCVE-2026-82985 · Other software · Nextcloud · reported by support@hackerone.comMedium 6.5
The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is used to determine which of the owner's files are searched — allowing them to discover files (name, file ID, and other metadata) in folders the album owner never intended to include in the shared album. This requires the album owner to have shared a filter-based smart album with the attacker; it does not allow access to arbitrary users' files without such a share.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability.CVE-2026-54471 · Other software · Dell · reported by security_alert@emc.comLow 3.5
Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- SmartFabric Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability.CVE-2026-26950 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- SmartFabric Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows anCVE-2026-89034 · Other software · TCH · reported by VulnCheckHigh 7.1
TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby attacker to connect to the device without pairing, authentication, or user approval by exploiting the exposed Nordic UART Service which enforces no client authentication or command authorization. Attackers within Bluetooth Low Energy range can connect directly to the ring, bypassing the official application and cloud authentication, to read battery levels, activate live heart rate monitoring, and retrieve stored historical heart rate and blood oxygen records.
- Product
- QRing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmrvar0x.commrvar0x.com
Sep 15, 2026An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service (DoS) orCVE-2025-66974 · Other software · reported by MITREHigh 7.5
An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service (DoS) or connection to an attacker-controlled device via supplying a crafted packet during the provisioning phase.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comprolink2u.com
Sep 15, 2026FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration.CVE-2026-91957 · Other software · FreeRDP · reported by VulnCheckLow 2.3
FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 15, 2026FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed CVE-2026-91945 · Other software · FreeRDP · reported by VulnCheckHigh 7.1
FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed inline arrays. Authenticated RDP clients can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses to trigger reads past stack or heap objects, causing process termination.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint.CVE-2026-88620 · Other software · reported by MITREMedium 4.3
SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve employee records belonging to other departments and users
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 20261024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module.CVE-2026-88619 · Other software · reported by MITREHigh 8.1
1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality intended for authorized administrators.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 20261024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality.CVE-2026-88618 · Other software · reported by MITREMedium 6.5
1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint.CVE-2026-88617 · Other software · reported by MITRECritical 9.8
SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability.CVE-2026-63696 · Other software · Dell · reported by security_alert@emc.comCritical 9.1
Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
- Product
- SmartFabric OS10 Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Session Fixation vulnerability.CVE-2026-63695 · Other software · Dell · reported by security_alert@emc.comCritical 9.8
Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Session Fixation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Session theft.
- Product
- SmartFabric OS10 Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2026Smart Marketing SMS and Newsletters Forms: Generic SQL InjectionCVE-2026-77161 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled (options['enabled']) and get_option('egoi_mapping') to be truthy, both of which reflect ordinary configured states for the plugin's core contact mapping functionality.
- Product
- Smart Marketing SMS and Newsletters Forms
- Affected
- up to 5.1.24
- What to do
- Affects up to 5.1.24. Update Smart Marketing SMS and Newsletters Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software Industry and Trade Inc.CVE-2026-7298 · Websites & servers · IdeaSoft Software Industry and Trade Inc. · reported by iletisim@usom.gov.trMedium 6.1
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected XSS. This issue affects Smart E-Commerce: before 8.4.2.0.
- Product
- Smart E-Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability.CVE-2026-89175 · Other software · Kingdom Communication Associated · reported by twcert@cert.org.twMedium 6.9
Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values.
- Product
- EH3040
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 11, 2026Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability.CVE-2026-89174 · Other software · Kingdom Communication Associated · reported by twcert@cert.org.twHigh 8.7
Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts.
- Product
- EH3040
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 11, 2026Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability.CVE-2026-89173 · Other software · Kingdom Communication Associated · reported by twcert@cert.org.twMedium 6.9
Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses.
- Product
- EH3040
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 8, 2026Untrusted search path in Windows Smart Card allows an authorized attacker to elevate privileges locally.CVE-2026-69785 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted search path in Windows Smart Card allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges.CVE-2026-33391 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comMedium 5.3
An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration. This allows the attacker to disrupt the visibility of assets in the monitored network.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.nozominetworks.comcert-portal.siemens.com
Sep 8, 2026An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target dCVE-2026-33389 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comMedium 5.3
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.nozominetworks.comcert-portal.siemens.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.