Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
604 results · page 3 of 13
Sep 2, 2026Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force.CVE-2026-81159 · Websites & servers · reported by mlhess@drupal.orgLow 3.7
Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove static DHCP reservatCVE-2026-51718 · Other software · reported by MITRECritical 9.8
Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain static DHCP reservatCVE-2026-51629 · Other software · reported by MITREMedium 4.3
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting.CVE-2026-11754 · Other software · Seres Software · reported by iletisim@usom.gov.trMedium 5.3
Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported.
- Product
- syWEB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force.CVE-2026-18259 · Websites & servers · reported by mlhess@drupal.orgHigh 7.5
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Observable discrepancy in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page.CVE-2026-79287 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.3
Observable discrepancy in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Observable discrepancy in HTML in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page.CVE-2026-79242 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.3
Observable discrepancy in HTML in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Observable discrepancy in Glic in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page.CVE-2026-79181 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.3
Observable discrepancy in Glic in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Observable discrepancy in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page.CVE-2026-79030 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.3
Observable discrepancy in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Observable discrepancy in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page.CVE-2026-79028 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.3
Observable discrepancy in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Observable discrepancy in SVG in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.CVE-2026-79016 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Observable discrepancy in SVG in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Observable discrepancy in PerformanceAPIs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain cross-origin data via a crafteCVE-2026-78955 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Observable discrepancy in PerformanceAPIs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installCVE-2026-78949 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comLow 2.9
Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installCVE-2026-78936 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comLow 2.9
Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 21, 2026Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearcCVE-2026-77811 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 6.2
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.
- Product
- Amazon OpenSearch Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Aug 21, 2026TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation.CVE-2026-54457 · Other software · tensorzero · reported by GitHubHigh 7.7
TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration. Selecting the filesystem storage type allows arbitrary files on the gateway filesystem to be read, including credential files. Selecting the s3_compatible storage type causes outbound object-storage requests to attacker-chosen internal or cloud-metadata endpoints. Exploitation requires access to the gateway, which can be authenticated or unauthenticated depending on deployment configuration. This issue is fixed in version 2026.6.0.
- Product
- tensorzero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.CVE-2026-69519 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.6
Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.
- Product
- Azure Stack HCI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables.CVE-2026-75531 · Other software · pandora-analysis · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 7
Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to HTML escaping by the template engine, it was embedded inside a JavaScript string within an HTML attribute. An attacker-controlled URL containing specially crafted characters could therefore break out of the JavaScript string and inject arbitrary JavaScript code. The malicious script would execute in the context of the Pandora web application when a victim interacts with the affected Submit to Lookyloo control. Successful exploitation could allow an attacker to access information available to the victim's browser or perform actions using the victim's authenticated Pandora session. The patch removes the observable value from the inline JavaScript handler. The URL is instead stored in an HTML data-url attribute and retrieved through the DOM dataset API when needed. Additional uses of innerHTML were also replaced with textContent as defensive hardening.
- Product
- pandora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state CVE-2026-72669 · Other software · Elastic · reported by security@elastic.coHigh 7.6
The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write arbitrary progress data into them. A tampered flow can also cause the owner's onboarding view to fail with a server error.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116).CVE-2026-72632 · Other software · Elastic · reported by security@elastic.coHigh 7.1
Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expressions over the stored field that holds the value, and evaluated them with Kibana's own internal Elasticsearch privileges rather than the caller's. Because the number of matching agents is reported back to the caller, the difference between a matching and a non-matching filter formed a side channel from which the full API key value could be reconstructed one character at a time with a short sequence of requests.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteratCVE-2026-14672 · Other software · Postgresql · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 5.3
Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.6, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.
- Product
- Postgresql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext.CVE-2026-14663 · Other software · Postgresql · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 6.5
Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection Code (MDC). Affected functions are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
- Product
- Postgresql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026: Observable Discrepancy vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions).CVE-2026-59502 · Other software · Priority · reported by cna@cyber.gov.ilMedium 5.3
: Observable Discrepancy vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3.
- Product
- Portal Generator addon to Priority ERP (developed by Soft Solutions)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Food Menu: Does not perform any capability or ownership check on its reservation-status update actionCVE-2026-13328 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.
- Product
- Food Menu
- Fixed in
- 6.0.2
- What to do
- Update Food Menu to 6.0.2 or newer.
Aug 11, 2026Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysiCVE-2026-43606 · Other software · AMD · reported by psirt@amd.comHigh 8.5
Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysis or electromagnetic emanation attacks, resulting in high confidentiality and integrity impact due to the exposure of private cryptographic keys.
- Product
- Vitis™ Libraries - Security Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Five Star Restaurant Reservations: Does not verify the authenticity of incoming payment notificationsCVE-2026-15147 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.
- Product
- Five Star Restaurant Reservations
- Fixed in
- 2.7.23
- What to do
- Update Five Star Restaurant Reservations to 2.7.23 or newer.
Aug 4, 2026Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc.CVE-2026-14202 · Other software · Bilin Software and Informatics Consultancy Inc. · reported by iletisim@usom.gov.trMedium 5.3
Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.
- Product
- HUMANIST Digital Human Resources
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026PaperCut NG/MF contains an observable timing discrepancy in its authentication component.CVE-2026-8794 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4Medium 6.9
PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.
- Product
- PaperCut NG/MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026Five Star Restaurant Reservations: Does not perform a capability check on one of its AJAX actionsCVE-2026-15151 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules.
- Product
- Five Star Restaurant Reservations
- Fixed in
- 2.7.23
- What to do
- Update Five Star Restaurant Reservations to 2.7.23 or newer.
Jul 31, 2026@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency.CVE-2026-54737 · Other software · phun-ky · reported by GitHubHigh 7.3
@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.
- Product
- defaults-deep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.CVE-2026-58048 · Websites & servers · reported by support@hackerone.comCritical 9.4
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cpanel.netsupport.cpanel.net
Jul 28, 2026IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototypeCVE-2026-14893 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.3
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.
- Product
- Observability with Instana (Agent)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2026In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchmaps reservation limit check xfs_exchmaps_estimate_overhead() adds the bmbt aCVE-2026-64357 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchmaps reservation limit check xfs_exchmaps_estimate_overhead() adds the bmbt and rmapbt overhead to a local resblks variable, but the final UINT_MAX check still tests req->resblks. That is the reservation value from before the overhead was added. The computed value is stored back in req->resblks and later passed to xfs_trans_alloc(), whose block reservation argument is unsigned int. Check the computed reservation so the existing limit applies to the value that will be used.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 15, 2026Cilium is a networking, observability, and security solution.CVE-2026-56743 · Other software · cilium · reported by GitHubMedium 5.4
Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName rather than the default any value. The parser incorrectly instantiates a pod selector on selectorless peer definitions, allowing traffic from other workloads in the same namespace as the subject of the policy. This issue is fixed in version 1.19.5.
- Product
- cilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Cilium is a networking, observability, and security solution.CVE-2026-56742 · Other software · cilium · reported by GitHubMedium 5.9
Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.
- Product
- cilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Cilium is a networking, observability, and security solution.CVE-2026-49445 · Other software · cilium · reported by GitHubCritical 9.2
Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.
- Product
- cilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists.CVE-2026-61503 · Other software · rejetto · reported by VulnCheckMedium 6.9
Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks.
- Product
- hfs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 11, 2026Planyo Online Reservation System: Server-Side Request Forgery leading to Local File InclusionCVE-2026-3576 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authentication. The send_http_post() function validates the host of the provided URL against an allowlist that includes 'localhost', but critically fails to validate the URL scheme/protocol. This makes it possible for unauthenticated attackers to supply a file:// URL (e.g., file://localhost/etc/passwd) which bypasses the host allowlist check because parse_url() returns 'localhost' as the host. The URL is then passed to curl_init() or fopen(), both of which support the file:// protocol, allowing the attacker to read arbitrary local files on the server and have their contents returned in the HTTP response. This can lead to disclosure of sensitive files such as /etc/passwd, wp-config.php (containing database credentials and authentication keys), and other server-side files.
- Product
- Planyo Online Reservation System
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Planyo Online Reservation System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026Starboard Suite Reservation Calendars: Stored Cross-Site ScriptingCVE-2025-13968 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Starboard Suite Reservation Calendars plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in the [starboard-suite-lightbox] shortcode in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Starboard Suite Reservation Calendars
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update Starboard Suite Reservation Calendars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 8, 2026OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables.CVE-2026-35211 · Other software · OpenCTI-Platform · reported by GitHubMedium 6.5
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elasticsearch Painless script values directly into search queries without validation or sanitization, allowing computationally expensive scripts to consume cluster CPU resources and degrade or deny service for all users. This issue is fixed in version 7.260401.0.
- Product
- opencti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables.CVE-2026-35210 · Other software · OpenCTI-Platform · reported by GitHubHigh 7.1
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions by injecting the synchronized-upsert: true HTTP header, enabling attackers to downgrade confidence levels, remove security markings such as TLP:RED, manipulate relationships, and affect STIX object types including Indicators, ThreatActors, Malware, and Reports. This issue is fixed in version 7.260326.0.
- Product
- opencti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Cilium is a networking, observability, and security solution.CVE-2026-53935 · Other software · cilium · reported by GitHubMedium 6.9
Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMatcher, enabling hijacking traffic to Services in any namespace and bypassing namespace scoping enforced by serviceMatcher; deleting such a policy can also corrupt Cilium internal service state and stop service translation for the affected Service. This issue is fixed in versions 1.17.16, 1.18.10, and 1.19.4.
- Product
- cilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and dirCVE-2026-53422 · Other software · Erlang · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbLow 2.3
Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points. The vulnerability leaks only the existence of paths. No file content
- Product
- OTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Jun 29, 2026Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob incrCVE-2026-57959 · Other software · HiEventsDev · reported by VulnCheckHigh 8.2
Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob increments it, allowing attackers to redeem limited promo codes unlimited times. Attackers can sequentially reserve multiple orders with the same restricted promo code, each reading order_usage_count=0 and passing validation, then complete them all at discounted prices without concurrent requests.
- Product
- Hi.Events
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 26, 2026An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, alloCVE-2023-20572 · Other software · AMD · reported by psirt@amd.comMedium 5.6
An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, allowing the input of an arbitrary message, potentially leading to a loss of data integrity.
- Product
- AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, alloCVE-2023-20540 · Other software · AMD · reported by psirt@amd.comLow 1.8
An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, allowing arbitrary message input, potentially leading to a loss of data integrity.
- Product
- AMD Ryzen™ 3000 Series Desktop Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in getcodepri function when processing unrecognized RINEX observation codes, allowing attackerCVE-2026-56788 · Other software · tomojitakasu · reported by VulnCheckMedium 4.8
RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in getcodepri function when processing unrecognized RINEX observation codes, allowing attackers to trigger denial of service. Crafted RINEX files with unknown observation types cause negative array indexing into the codepris table, resulting in reliable crashes and potential memory disclosure of adjacent global data.
- Product
- RTKLIB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 25, 2026Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.CVE-2026-54830 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.
- Affected
- up to 2.7.19
- What to do
- Affects up to 2.7.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: restore reservation on error in hugetlb folio copy paths Two sites in mm/hugetCVE-2026-53154 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: restore reservation on error in hugetlb folio copy paths Two sites in mm/hugetlb.c allocate a hugetlb folio via alloc_hugetlb_folio() (consuming a VMA reservation) and then call copy_user_large_folio(), which became int-returning in commit 1cb9dc4b475c ("mm: hwpoison: support recovery from HugePage copy-on-write faults") and can now fail (e.g. -EHWPOISON on a hwpoisoned source page). On the failure path, folio_put() restores the global hugetlb pool count through free_huge_folio(), but the per-VMA reservation map entry is left marked consumed: - hugetlb_mfill_atomic_pte() resubmission path (UFFDIO_COPY) - copy_hugetlb_page_range() fork-time CoW path when hugetlb_try_dup_anon_rmap() fails (rare: pinned hugetlb anon folio under fork) User-visible effect: on UFFDIO_COPY into a private hugetlb VMA where the resubmission copy fails, the reservation for that address is leaked from the VMA's reserve map. A subsequent fault at the same address takes the no-reservation path, and under hugetlb pool pressure the task is SIGBUSed at an address it had previously reserved. The fork-time CoW path le
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 19, 2026Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queriesCVE-2019-25750 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hotel_id parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL UNION SELECT statements to extract sensitive database information including table names and column data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcmsjunkie.comextensions.joomla.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.