Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

439new WordPress flaws this week

394,398entries in the database

331,033 results · page 30 of 6621

Nov 4, 2026WPvivid — Backup, Migration & Staging: Does not verify that a submitted snapshot identifier names a snapshot it actually created before using itCVE-2026-115241 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other string, and cause the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 to drop every matching table, including the core WordPress tables, destroying the site's database.
Product
WPvivid — Backup, Migration & Staging
Fixed in
0.9.137
What to do
Update WPvivid — Backup, Migration & Staging to 0.9.137 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Enable Media Replace: Does not pass a replaced media file through the WordPress upload pipelineCVE-2026-114431 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads.
Product
Enable Media Replace
Fixed in
4.2.3
What to do
Update Enable Media Replace to 4.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Duplicator WordPress plugin before 5.1.0, duplicator-pro: Does not prevent direct access to some of its bundled PHP filesCVE-2026-112244 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.
Product
Duplicator WordPress plugin before 5.1.0, duplicator-pro
Fixed in
5.1.0
What to do
Update Duplicator WordPress plugin before 5.1.0, duplicator-pro to 5.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026WP Remote Users Sync: Does not adequately restrict access to the user export files it writes beneath the public web rootCVE-2026-111962 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests the export's predictable file name while it is present to retrieve the exported users' personal data.
Product
WP Remote Users Sync
Fixed in
2.2.0
What to do
Update WP Remote Users Sync to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Post Duplicator: Does not check whether the requesting user may view each post before returning a list of posts for a post typeCVE-2026-111740 · WordPress plugins & themes · reported by WPScanLow 2.7
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.
Product
Post Duplicator
Fixed in
3.0.17
What to do
Update Post Duplicator to 3.0.17 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Essential Real Estate: Does not verify that a media attachment belongs to the requesting user before deleting itCVE-2026-110964 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.
Product
Essential Real Estate
Fixed in
5.3.5
What to do
Update Essential Real Estate to 5.3.5 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026PowerPack Addons for Elementor: Widgets, Form Styler and Templates: Does not validate a user-supplied URL before using it in a server-side HTTP requestCVE-2026-110692 · WordPress plugins & themes · reported by WPScanMedium 4.1
The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.
Product
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
Fixed in
3.1.3
What to do
Update PowerPack Addons for Elementor: Widgets, Form Styler and Templates to 3.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026FV Flowplayer Video Player: Does not perform proper authorization checks on one of its video-migration functionsCVE-2026-108068 · WordPress plugins & themes · reported by WPScanLow 3.8
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212's stored video records across the whole site.
Product
FV Flowplayer Video Player
Fixed in
7.5.56.7212
What to do
Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026FV Flowplayer Video Player: Does not properly verify record ownership before modifying or deleting stored video and meta recordsCVE-2026-108067 · WordPress plugins & themes · reported by WPScanLow 3.8
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.
Product
FV Flowplayer Video Player
Fixed in
7.5.56.7212
What to do
Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026SEOPress: Does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end pageCVE-2026-108041 · WordPress plugins & themes · reported by WPScanHigh 7.1
The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.
Product
SEOPress
Fixed in
10.4
What to do
Update SEOPress to 10.4 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configurationCVE-2026-106649 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator.
Product
Kali Forms — Contact Form & Drag-and-Drop Builder
Fixed in
2.4.29
What to do
Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.29 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Form Maker by 10Web: Does not consistently escape user-submitted field values before rendering them on its submissions admin pageCVE-2026-105413 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who views the submissions.
Product
Form Maker by 10Web
Fixed in
1.15.51
What to do
Update Form Maker by 10Web to 1.15.51 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce: Does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record changeCVE-2026-105191 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users' sensitive HR, CRM and Accounting data by enumerating record identifiers.
Product
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
Fixed in
1.17.11
What to do
Update ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce to 1.17.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026CookieYes: Does not correctly restrict who can write its cookie-category script fieldsCVE-2026-104719 · WordPress plugins & themes · reported by WPScanMedium 6.4
The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content.
Product
CookieYes
Fixed in
3.5.8
What to do
Update CookieYes to 3.5.8 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Mollie Payments for WooCommerce: Does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpointCVE-2026-101166 · WordPress plugins & themes · reported by WPScanLow 3.7
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products.
Product
Mollie Payments for WooCommerce
Fixed in
8.2.0
What to do
Update Mollie Payments for WooCommerce to 8.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Mollie Payments for WooCommerce: Does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge feeCVE-2026-101165 · WordPress plugins & themes · reported by WPScanLow 3.7
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.
Product
Mollie Payments for WooCommerce
Fixed in
8.2.0
What to do
Update Mollie Payments for WooCommerce to 8.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled.CVE-2025-11229 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8High 7.2
The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls. Exploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the `authorize_all_scopes` configuration deviates from its default disabled state.
Product
WSO2 Identity Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.docs.wso2.com
Nov 4, 2026Multiple Akeeba products lack the anti-CSRF check on some actions.CVE-2026-105296 · Other software · Akeeba Ltd. · reported by vultures@jpcert.or.jpMedium 5.1
Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed.
Product
Akeeba Backup for Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp akeeba.com
Nov 3, 2026Memory Corruption when processing firmware update data in Download mode due to a missing bounds check.CVE-2026-80335 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.6
Memory Corruption when processing firmware update data in Download mode due to a missing bounds check.
Product
Bootloader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record unisoc.com
Nov 3, 2026Transient DOS when processing a malformed NR RRC configuration message due to improper input validation.CVE-2026-79405 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.5
Transient DOS when processing a malformed NR RRC configuration message due to improper input validation.
Product
Modem
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record unisoc.com
Nov 3, 2026@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a callCVE-2026-121802 · Other software · better-auth · reported by MITRECritical 9.1
@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.
Product
Better Auth
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 3, 2026A weakness has been identified in Linksys E5600 1.1.0.26.CVE-2026-121618 · Network & remote access · Linksys · reported by VulDBMedium 5.5
A weakness has been identified in Linksys E5600 1.1.0.26. This affects an unknown part of the file /cgi-bin/fqc.cgi of the component Factory Quality Control. This manipulation causes information disclosure. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Product
E5600
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Nov 3, 2026A security flaw has been discovered in Linksys E5600 1.1.0.26.CVE-2026-121617 · Network & remote access · Linksys · reported by VulDBHigh 7.7
A security flaw has been discovered in Linksys E5600 1.1.0.26. Affected by this issue is the function init_multipart of the file /cgi-bin/upload_fw.cgi of the component Header Parser. The manipulation results in out-of-bounds write. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Product
E5600
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Nov 3, 2026Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a cCVE-2026-84730 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.7
Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a crafted device name. Refer to the ' Security Update for ASUS Router AiCloud Feature ' section on the ASUS Security Advisory for more information.
Product
Router firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record asus.com
Nov 3, 2026Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or potentially cause a denCVE-2026-84729 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 7.2
Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or potentially cause a denial-of-service (DoS) via a crafted packet. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Product
Router firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record asus.com
Nov 3, 2026A security flaw has been discovered in funadmin 7.1.0.CVE-2026-121610 · Other software · reported by VulDBMedium 5.5
A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/index of the component Frontend List Endpoint. The manipulation of the argument selectFields results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Nov 3, 2026A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566.CVE-2026-121609 · Other software · Qihoo 360 · reported by VulDBCritical 9.3
A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Product
Whole Home Router M5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com vuldb.com
Nov 3, 2026A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2.CVE-2026-121608 · Other software · Qihoo 360 · reported by VulDBMedium 5.5
A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message of the file /fs2/bin/iscm of the component Timezone Push Handler. Executing a manipulation of the argument tz can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.4.0 is able to resolve this issue. Upgrading the affected component is advised. Firmware 6.4.0 gates the path with a new check_timezone_parameter validation (verified by VulDB vulnerability analysis team via disassembly).
Product
D603-2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com vuldb.com
Nov 3, 2026A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9.CVE-2026-121607 · Other software · Qihoo 360 · reported by VulDBCritical 9.3
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Product
D603-2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com vuldb.com
Nov 3, 2026An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbitrary physical memoCVE-2026-112116 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.5
An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbitrary physical memory through crafted device control requests, ultimately resulting in a complete compromise of the affected system. Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.
Product
System Control Interface
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record asus.com
Nov 3, 2026Missing authorization in ASUS Armoury Crate allows a local attacker to write content into a specific file or registry location with Local System privileges, or CVE-2026-110464 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 6.9
Missing authorization in ASUS Armoury Crate allows a local attacker to write content into a specific file or registry location with Local System privileges, or to cause a recoverable system crash, via the service's exposed inter-process interface. Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
Product
Armoury Crate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record asus.com
Nov 3, 2026A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9.CVE-2026-121606 · Other software · Qihoo 360 · reported by VulDBCritical 9.3
A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Product
D621-2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com vuldb.com
Nov 3, 2026A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104.CVE-2026-121600 · Other software · TOTOLINK · reported by VulDBHigh 8.6
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEffect causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.
Product
A950RG
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com vuldb.com
Nov 3, 2026A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104.CVE-2026-121598 · Other software · TOTOLINK · reported by VulDBHigh 8.6
A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/cstecgi.cgi of the component Basic Wireless Configuration Handler. The manipulation of the argument wepkey leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Product
A950RG
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com vuldb.com
Nov 3, 2026Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability.CVE-2026-92200 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 7.8
Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from incorrect permissions on a folder used by the product. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31118.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Nov 3, 2026Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability.CVE-2026-92199 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 7.8
Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the symmetricDecrypt method. The issue results from the use of a hard-coded cryptographic key. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29967.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Nov 3, 2026Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability.CVE-2026-92198 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.2
Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getSource method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-29934.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Nov 3, 2026Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability.CVE-2026-92197 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the unzipFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29901.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Nov 3, 2026Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability.CVE-2026-92196 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 7.2
Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the renderTemplateString method. The issue results from the lack of proper validation of a user-supplied string before processing it with the template engine. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29889.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Nov 3, 2026Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability.CVE-2026-92195 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the loadEvolveLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29232.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Nov 3, 2026Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability.CVE-2026-92194 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the loadManageServerLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29231.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Nov 3, 2026Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure Vulnerability.CVE-2026-92193 · Other software · Quest · reported by zdi-disclosures@trendmicro.comMedium 6.5
Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the FileServlet class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-29216.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Nov 3, 2026Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability.CVE-2026-92192 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the installLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29215.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Nov 3, 2026Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability.CVE-2026-92191 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the runScript function. The issue results from incorrect authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29192.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Nov 3, 2026Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2026-92190 · Other software · Quest · reported by zdi-disclosures@trendmicro.comCritical 9.8
Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the baseRmiServiceExporter bean. The issue results from the lack of proper validation of user-supplied data prior to deserializing it. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29170.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Nov 3, 2026Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability.CVE-2026-92189 · Other software · Quest · reported by zdi-disclosures@trendmicro.comCritical 9.8
Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the writeTopologySectionToFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29169.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Nov 3, 2026Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability.CVE-2026-92188 · Other software · Quest · reported by zdi-disclosures@trendmicro.comCritical 9.8
Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ForgeMBeanServerSupport module. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29168.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Nov 3, 2026Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability.CVE-2026-92187 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the extractAndCreateUploadInfoList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29039.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Nov 3, 2026Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability.CVE-2026-92186 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the paFnUploadFileAndCreateInfo script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29038.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Nov 3, 2026Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability.CVE-2026-92185 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 7.2
Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AbstractParser class. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-28929.
Product
Foglight for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.