Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,803 results · page 31 of 277
Aug 5, 2026Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-suCVE-2026-54418 · Other software · Leantime · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.1
Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed methods in the same dispatcher).
- Product
- Leantime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026User Registration & Membership: Does not enforce the site's registration-disabled settingCVE-2026-16736 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.
- Product
- User Registration & Membership
- Fixed in
- 5.2.6
- What to do
- Update User Registration & Membership to 5.2.6 or newer.
Aug 5, 2026GeoDirectory: Does not sanitise and escape a place-category setting before outputting it back in an admin pageCVE-2025-15677 · WordPress plugins & themes · reported by WPScanLow 3.5
The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
- Product
- GeoDirectory
- Fixed in
- 2.8.110
- What to do
- Update GeoDirectory to 2.8.110 or newer.
Aug 5, 2026The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account tCVE-2026-9273 · WordPress plugins & themes · reported by WordfenceCritical 9.3
The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rc_process_lost_password_form() consuming the attacker-controlled rc_redirect POST parameter into two unvalidated sinks in legacy/includes/forms.php: wp_redirect( esc_url( $_POST['rc_redirect'] ) . ... ) at line 243, and add_query_arg( array( 'key' => $key, 'login' => ... ), $_POST['rc_redirect'] ) inside rc_send_password_reset_email() at line 306. The nonce required to reach the handler is broadcast by the public [login_form] shortcode at line 207 to any anonymous visitor. This makes it possible for unauthenticated attackers to issue a password-reset request for any account (including administrators) whose reset email body points the victim at an attacker-controlled host carrying a valid reset key/login. When the victim clicks the link, the reset key leaks to the attacker, who can replay it against the legitimate site to complete account takeover.
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 4, 2026PowerPress Podcasting plugin by Blubrry: Does not sanitise and escape some of its Podcast Episode settingsCVE-2026-16293 · WordPress plugins & themes · reported by WPScanMedium 6.8
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- PowerPress Podcasting plugin by Blubrry
- Fixed in
- 11.16.11
- What to do
- Update PowerPress Podcasting plugin by Blubrry to 11.16.11 or newer.
Aug 4, 2026Quiz and Survey Master (QSM): Does not properly escape a question setting before outputting it into an unquoted HTML attributeCVE-2026-14824 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 11.2.2
- What to do
- Update Quiz and Survey Master (QSM) to 11.2.2 or newer.
Aug 3, 2026Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows aCVE-2026-11835 · Other software · Caliptra · reported by b01ddd03-5ef6-483b-b2c5-acba77f1a554Medium 5.7
Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, enabling firmware to be modified between verification and loading into ICCM. Attestation continues to report the originally verified image digest, masking the compromise. Exploitation requires a compromised MCU firmware with AXI manager access to unprotected SRAM reachable by Caliptra. This issue affects Core ROM: 2.1.0 through 2.1.1.
- Product
- Core ROM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal.CVE-2026-67970 · Other software · reported by MITREHigh 7.5
Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl entCVE-2026-67969 · Other software · reported by MITREHigh 7.5
An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl entry.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API.CVE-2026-68980 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 2.3
Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework performed authorized based on the supplied Parameter Context Identifier without verifying the requested Identifier against the stored Identifier. Apache NiFi installations that do not implement different levels of authorization across Parameter Contexts are not subject to this vulnerability, because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which verifies Parameter Context ownership of the requested Asset before deletion using the same strategy applied to Asset read operations.
- Product
- Apache NiFi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 3, 2026SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoCVE-2026-69083 · Other software · siyuan-note · reported by VulnCheckCritical 9.9
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 3, 2026Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where tCVE-2026-64827 · Other software · Telenia Software · reported by VulnCheckCritical 9.3
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.
- Product
- TVox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.comteleniasoftware.com
Aug 3, 2026ChamaWP: Does not properly validate a password reset requestCVE-2026-16300 · WordPress plugins & themes · reported by WPScanCritical 9.8
The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
- Product
- ChamaWP
- Fixed in
- 1.0.13
- What to do
- Update ChamaWP to 1.0.13 or newer.
Aug 3, 2026In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard.CVE-2026-13506 · Other software · Legion of the Bouncy Castle Inc. · reported by 91579145-5d7b-4cc5-b925-a0262ff19630High 8.7
In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
- Product
- BC-JAVA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In geniezone, there is a possible escalation of privilege due to a missing permission check.CVE-2026-20498 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6
In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10900493; Issue ID: MSV-6765.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In geniezone, there is a possible out of bounds write due to a missing bounds check.CVE-2026-20497 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6
In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10965550 / ALPS11393405; Issue ID: MSV-6941.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In geniezone, there is a possible out of bounds read due to a missing bounds check.CVE-2026-20496 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 4.4
In geniezone, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11036877; Issue ID: MSV-7132.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In Bluetooth driver, there is a possible permission bypass due to a missing permission check.CVE-2026-20495 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comHigh 7.8
In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00488300; Issue ID: MSV-7296.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In wifi, there is a possible out of bounds read due to a missing bounds check.CVE-2026-20494 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 5.5
In wifi, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10960006 / BORA00155314, BORA00155001, BORA00154907; Issue ID: MSV-7570.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In wifi, there is a possible out of bounds write due to a missing bounds check.CVE-2026-20493 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 4.4
In wifi, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: BORA00154903; Issue ID: MSV-7575.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In Audio HAL, there is a possible system becoming unresponsive due to a race condition.CVE-2026-20492 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 5.5
In Audio HAL, there is a possible system becoming unresponsive due to a race condition. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10960026 (Note: For MT6880, MT6890, MT6990, MT6988) / AUTO00851250 (Note: For MT2735, MT2737); Issue ID: MSV-7583.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In med, there is a possible out of bounds write due to an incorrect bounds check.CVE-2026-20491 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 5.5
In med, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981478 (Note: For MT6890, MT6990, MT6988) / AUTO00851173 (Note: For MT2735, MT2737); Issue ID: MSV-7652.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In ccci, there is a possible out of bounds read due to a missing bounds check.CVE-2026-20490 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 4.4
In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10981501; Issue ID: MSV-7669.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In display, there is a possible information disclosure due to an integer overflow.CVE-2026-20489 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 4.4
In display, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004274; Issue ID: MSV-7749.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In display, there is a possible information disclosure due to a missing bounds check.CVE-2026-20488 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 4.4
In display, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004276; Issue ID: MSV-7757.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In imgsensor, there is a possible application crash due to incorrect error handling.CVE-2026-20486 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In imgsensor, there is a possible application crash due to incorrect error handling. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11012302; Issue ID: MSV-7833.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In HFRP, there is a possible out of bounds write due to a missing bounds check.CVE-2026-20485 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6
In HFRP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11049569; Issue ID: MSV-7931.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In TFA, there is a possible information disclosure due to a missing permission check.CVE-2026-20484 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 4.4
In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11053160; Issue ID: MSV-8004.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In Telephony, there is a possible escalation of privilege due to a missing permission check.CVE-2026-20483 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comHigh 7.7
In Telephony, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11087526; Issue ID: MSV-8243.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In wlan STA FW, there is a possible system becoming unresponsive due to logging.CVE-2026-20482 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.5
In wlan STA FW, there is a possible system becoming unresponsive due to logging. This could lead to remote (proximal/adjacent) denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00486814; Issue ID: MSV-6824.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In geniezone, there is a possible out of bounds write due to a missing bounds check.CVE-2026-20481 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6
In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10965373; Issue ID: MSV-6935.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow.CVE-2026-20480 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 5.5
In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10960023 (Note: For MT6880, MT6890, MT6980D, MT6988, MT6990) / AUTO00851189 (Note: For MT2735, MT3737); Issue ID: MSV-7586.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In Modem, there is a possible out of bounds read due to a missing bounds check.CVE-2026-20479 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comHigh 7.5
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00741071; Issue ID: MSV-7620.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow.CVE-2026-20478 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 5.5
In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981454 (Note: For MT6880, MT6890, MT6988, MT6990) / AUTO00851293 (Note: For MT2735, MT2737); Issue ID: MSV-7638.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In display, there is a possible out of bounds write due to a missing bounds check.CVE-2026-20477 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11009963; Issue ID: MSV-7658.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In ccci, there is a possible out of bounds read due to a missing bounds check.CVE-2026-20476 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 5.5
In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981532; Issue ID: MSV-7660.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In display, there is a possible out of bounds write due to a missing bounds check.CVE-2026-20475 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004276; Issue ID: MSV-7748.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In display, there is a possible escalation of privilege due to a race condition.CVE-2026-20474 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6
In display, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019183; Issue ID: MSV-7758.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In display, there is a possible memory corruption due to use after free.CVE-2026-20473 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019722; Issue ID: MSV-7759.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In TFA, there is a possible out of bounds write due to a missing bounds check.CVE-2026-20472 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 4.4
In TFA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10991467; Issue ID: MSV-7764.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In DA, there is a possible out of bounds write due to a missing bounds check.CVE-2026-20471 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 4.6
In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10991588 (Note: For MT6880, MT6890, MT6990, MT6988, MT6986, MT6813) / AUTO00851171 (Note: For MT2735, MT2737); Issue ID: MSV-7790.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In Telephony, there is a possible information disclosure due to a missing permission check.CVE-2026-20470 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.2
In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11086431; Issue ID: MSV-8189.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In trusted_mem, there is a possible escalation of privilege due to improper input validation.CVE-2026-20469 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6
In trusted_mem, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: AUTO00834868; Issue ID: MSV-6533.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In apusys, there is a possible escalation of privilege due to a confused deputy.CVE-2026-20468 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6
In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00833804; Issue ID: MSV-6741.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In apusys, there is a possible escalation of privilege due to a missing bounds check.CVE-2026-20467 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6
In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00837766; Issue ID: MSV-6767.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In sec boot, there is a possible escalation of privilege due to a heap buffer overflow.CVE-2026-20466 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.1
In sec boot, there is a possible escalation of privilege due to a heap buffer overflow. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: AUTO00845351 (Note: For MT2737) / ALPS11072643 (Note: For MT6880, MT6890, MT6990); Issue ID: MSV-6929.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In wlan AP driver, there is a possible out of bounds write due to a missing bounds check.CVE-2026-20465 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comHigh 8.1
In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00489200; Issue ID: MSV-7834.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026In hevc decoder, there is a possible out of bounds write due to an integer overflow.CVE-2026-20464 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.5
In hevc decoder, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11104718; Issue ID: MSV-8297.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cCVE-2026-67357 · Other software · ArcadeData · reported by VulnCheckHigh 7.7
ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and achieve full server compromise.
- Product
- arcadedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 2, 2026better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset).CVE-2025-71401 · Other software · better-auth · reported by VulnCheckCritical 9.3
better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.
- Product
- better-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.