Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,830 results · page 31 of 137
Aug 11, 2026Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.CVE-2026-61367 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Double free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.CVE-2026-61366 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Double free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.CVE-2026-61365 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.CVE-2026-61364 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-61359 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Improper link resolution before file access ('link following') in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate pCVE-2026-61358 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper link resolution before file access ('link following') in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Use after free in Application Information Services allows an authorized attacker to elevate privileges locally.CVE-2026-61357 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Application Information Services allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.CVE-2026-61356 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.CVE-2026-61355 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Heap-based buffer overflow in Windows Telephony Service allows an authorized attacker to elevate privileges locally.CVE-2026-61353 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally.CVE-2026-61349 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2026-61348 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-61346 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Execution with unnecessary privileges in Microsoft High Performance Computing (HPC) Pack allows an authorized attacker to elevate privileges over a network.CVE-2026-59133 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Execution with unnecessary privileges in Microsoft High Performance Computing (HPC) Pack allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft HPC Pack 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-59127 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.CVE-2026-59125 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevatCVE-2026-59122 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.CVE-2026-59119 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.
- Product
- PowerShell 7.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.CVE-2026-58641 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
- Product
- SkiaSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privilCVE-2026-57104 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Storage Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.CVE-2026-56174 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges over a network.CVE-2026-50516 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.4
Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges over a network.
- Product
- Azure Kubernetes Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.CVE-2026-50472 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges oCVE-2026-47299 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network.
- Product
- Azure Monitor Agent Linux Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally.CVE-2026-42976 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitives within Ring 0: Kernel may allow a deniaCVE-2025-35987 · Other software · reported by secure@intel.comMedium 4.3
Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitives within Ring 0: Kernel may allow a denial of service. Authorized adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (low) impacts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credeCVE-2026-6726 · Other software · Trusted Computing Group · reported by cret@cert.orgHigh 7.9
An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010.
- Product
- TPM2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrustedcomputinggroup.orgtrustedcomputinggroup.org
Aug 11, 2026n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation.CVE-2026-72765 · Other software · n8n-io · reported by VulnCheckHigh 8.7
n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the host running n8n. The issue is fixed in versions 2.31.5 and 2.32.1.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 11, 2026Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports.CVE-2026-73140 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 5.3
Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges, build_evaluation_report() previously included all evaluation comments without applying those rules. Consequently, a user who was authorized to view a conversion could export its evaluation report as Markdown or PDF and obtain private evaluation comments that should only have been visible to the conversion owner, the comment author, or an administrator. The leaked report data also contained the comment author's name. The fix passes the requesting user into the report builder and filters every evaluation comment using the shared access.can_see_comment() authorization function.
- Product
- cti-transmute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A flaw was found in the trustyai-service-operator's LMEvalJob controller.CVE-2026-15467 · Other software · Red Hat · reported by Red HatHigh 8.1
A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster.
- Product
- Red Hat OpenShift AI 2.25
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 10, 2026In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update MGMT_OP_LOAD_CONN_PARAM queues cCVE-2026-68394 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update MGMT_OP_LOAD_CONN_PARAM queues conn_update_sync() when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hci_conn_params entry from hdev->le_conn_params. A later LOAD_CONN_PARAM request can clear disabled parameters and free that entry before hci_cmd_sync_work() runs the queued callback. Do not keep the borrowed hci_conn_params pointer in queued work. Queue the hci_conn instead and hold a reference until the queued callback completes. When the work runs, revalidate that the connection is still present, look up the current hci_conn_params entry, and cancel the update if userspace removed that entry while the work was pending. Copy the interval values from the current params entry under hdev->lock, then drop the lock and keep using hci_le_conn_update_sync() to issue the update. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in conn_update_sync+0x2a/0xf0 [bluetooth] Read of size 1 at addr ffff88810c697126 by task kworker/u17:0/377 Workqueue: hci0 hci_cmd_sync_work [bl
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 10, 2026In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: validate and free ACPI mute object cs35l41_get_acpi_mute_state() evaluCVE-2026-68346 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: validate and free ACPI mute object cs35l41_get_acpi_mute_state() evaluates a _DSM method to get the ACPI mute state and reads the first byte from the returned object. However, the returned ACPI object is owned by the caller and is never freed after use, so each successful query leaks the _DSM result object. The code also assumes that the returned object is a buffer with at least one byte. A malformed firmware response can return a different object type or an empty buffer, and the direct ret->buffer.pointer dereference can then access an invalid pointer. Use the typed _DSM helper, validate that the returned buffer contains at least one byte, and free the ACPI object after reading it.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 7, 2026LightRAG provides simple and fast retrieval-augmented generation.CVE-2026-61808 · Other software · HKUDS · reported by GitHubCritical 9.8
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1.
- Product
- LightRAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.CVE-2026-65668 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Purview eDiscovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.CVE-2026-65667 · Email & office · Microsoft · reported by secure@microsoft.comCritical 10
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Teams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.CVE-2026-63508 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Planetary Computer Pro (GeoCatalog)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.CVE-2026-62896 · Email & office · Microsoft · reported by secure@microsoft.comCritical 9.6
Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Teams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.CVE-2026-62873 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft 365 Admin Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a nCVE-2026-62836 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.7
Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure SQL Managed Instance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.CVE-2026-62830 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
- Product
- Azure SRE Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.CVE-2026-59118 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.
- Product
- Copilot Cowork
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.CVE-2026-59115 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Entra Provisioning Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.CVE-2026-56162 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure SQL Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.CVE-2026-50481 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
- Product
- Azure Active Directory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privileCVE-2026-49163 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privileges over a network.
- Product
- Application Insights Profiler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties.CVE-2026-0637 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 4.4
When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information, such as user credentials or other confidential data, that was inadvertently logged due to misconfiguration, potentially leading to unauthorized access.
- Product
- WSO2 API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Aug 5, 2026The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard.CVE-2026-15941 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 3, 2026A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.CVE-2026-56846 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could rCVE-2026-48317 · Other software · Adobe · reported by AdobeCritical 9.6
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Campaign Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an atCVE-2026-18667 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comCritical 9.3
A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host.
- Product
- Sensor Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.