Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,830 results · page 32 of 137
Aug 3, 2026CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality.CVE-2026-69078 · Other software · misp · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 8.8
CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before the patch, the renderer used WeasyPrint’s default URL-fetching behavior without restricting the protocols or destinations that could be referenced by the generated HTML. An attacker able to supply content included in an evaluation report could inject crafted resource references using schemes such as http://, https://, or file://. When the report was rendered, CTI-Transmute could fetch these resources using the application server’s network connectivity and filesystem privileges. Successful exploitation could allow an attacker to: * access services available only from the CTI-Transmute server or its internal network; * probe internal hosts and service endpoints; * retrieve local files readable by the application process; and * expose fetched content through the generated PDF, depending on the referenced resource type and rendering context. The vulnerability is corrected by pro
- Product
- cti-transmute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted filCVE-2026-9593 · Other software · Endress+Hauser · reported by info@cert.vde.comHigh 8.4
A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disruption of device data or operation.
- Product
- FDI Package library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution.CVE-2026-18203 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs to a different group with a similar starting name to bypass security checks and gain unauthorized access to administrative functions or protected resources.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jul 30, 2026Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate priCVE-2026-22622 · Other software · Eaton · reported by CybersecurityCOE@eaton.comHigh 8.8
Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device.
- Product
- PADM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber.CVE-2026-50737 · Other software · EnterpriseDB · reported by 20be33e2-bf35-4d13-8fad-18bd2f3e3659Critical 9
When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Because the apply worker runs at a privilege level equivalent to a PostgreSQL superuser in default installations, any function invoked by such a default expression also runs at that privilege. A party acting as the publisher can use this path to cause functions to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser. This is a second, independent path to the same superuser escalation tracked under CVE-2026-50736 (the pglogical queue issue). To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.
- Product
- pglogical
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.CVE-2026-59533 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template ruCVE-2026-61511 · Other software · vBulletin · reported by VulnCheckCritical 9.3
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.
- Product
- vBulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.vbulletin.comforum.vbulletin.com
Jul 25, 2026In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation pcc_cpufreq_do_osc() cCVE-2026-64372 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the two-phase _OSC negotiation. Between the two calls it freed output.pointer but left output.length unchanged. Since acpi_evaluate_object() treats a non-zero length with a non-NULL pointer as an existing buffer to write into, the second call wrote into freed memory (use-after-free). The subsequent kfree(output.pointer) at out_free then freed the same pointer a second time (double free). Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER after freeing the first result, so ACPICA allocates a fresh buffer for each phase independently.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 24, 2026Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.CVE-2026-60134 · Other software · Weintek · reported by ics-cert@hq.dhs.govHigh 8.7
Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.
- Product
- cMT3092X firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.weintek.comgithub.com
Jul 24, 2026NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controCVE-2025-71408 · Other software · ntlk · reported by VulnCheckHigh 8.5
NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the __main__ block passes command-line arguments directly to eval() as suffixes of BigramAssocMeasures without allowlist validation or sanitization, enabling an attacker to supply a Python expression that escapes the intended attribute lookup and executes arbitrary code including OS commands via the os module.
- Product
- ntlk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaydinnyunus.github.iogithub.com
Jul 24, 2026Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.CVE-2026-58630 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure App Service for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2026Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.CVE-2026-57106 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Purview Data Governance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2026Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.CVE-2026-56163 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Kubernetes Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.CVE-2026-62825 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Key Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.CVE-2026-58275 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure DNS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network.CVE-2026-56167 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.5
Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network.
- Product
- Azure AI Search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.CVE-2026-56160 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.1
Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.
- Product
- Azure Red Hat OpenShift (ARO)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions.CVE-2026-65903 · Other software · cure53 · reported by VulnCheckMedium 5.1
DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.
- Product
- DOMPurify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 23, 2026@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution.CVE-2026-7120 · Other software · @fastify/static · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 5.3
@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2.
- Product
- @fastify/static
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Jul 22, 2026n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler.CVE-2026-65591 · Other software · n8n-io · reported by VulnCheckHigh 8.9
n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 21, 2026A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level accCVE-2026-56844 · Other software · Veeam · reported by support@hackerone.comHigh 8.4
A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system.
- Product
- Backup and Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group.CVE-2026-28307 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments.
- Product
- Serv-U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Jul 21, 2026SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator.CVE-2026-28306 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments.
- Product
- Serv-U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Jul 21, 2026WPBot: Does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlersCVE-2026-14185 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration.
- Product
- WPBot
- Fixed in
- 8.2.0
- What to do
- Update WPBot to 8.2.0 or newer.
Jul 20, 2026SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KECVE-2026-63755 · Other software · surrealdb · reported by VulnCheckHigh 7.1
SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements) against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user — including Record and Scope users — can exploit this ordering flaw to read the full contents of any table in the database they are authenticated against, bypassing table-level permission checks. Exfiltration is most direct when scripting functions are enabled (--allow-scripting), but is also possible via SurrealQL's THROW statement and timing-based side channels without scripting. The vulnerability is confined to the attacker's current database and does not cross namespace or database isolation boundaries.
- Product
- surrealdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 20, 2026SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREACVE-2026-63754 · Other software · surrealdb · reported by VulnCheckHigh 7.1
SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only select permission can prevent write operations on a table for any user, including root, by registering a LIVE query that triggers evaluation errors until the query is killed or the session ends.
- Product
- surrealdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 19, 2026In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prefer NLA_NUL_STRING These attributes are evaluated as c-string (passed to strCVE-2026-63860 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.4
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prefer NLA_NUL_STRING These attributes are evaluated as c-string (passed to strcmp), but NLA_STRING doesn't check for the presence of a \0 terminator. Either this needs to switch to nla_strcmp() and needs to adjust printf fmt specifier to not use plain %s, or this needs to use NLA_NUL_STRING. As the code has been this way for long time, it seems to me that userspace does include the terminating nul, even tough its not enforced so far, and thus NLA_NUL_STRING use is the simpler solution.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 19, 2026In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int() lwmi_dev_evalCVE-2026-63839 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int() lwmi_dev_evaluate_int() leaks output.pointer when retval == NULL (found by sashiko.dev [1]). Fix it by moving `ret_obj = output.pointer' outside of the `if (retval)' block so that it is always freed by the __free cleanup callback. No functional change intended.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 17, 2026NCalc is a fast, lightweight expression evaluator for .NET.CVE-2026-55254 · Other software · ncalc · reported by GitHubMedium 4.8
NCalc is a fast, lightweight expression evaluator for .NET. Prior to 6.1.1, the factorial operator implementation in src/NCalc.Core/Helpers/MathHelper.cs permits specially crafted expressions with extremely large factorial operands, causing excessive CPU consumption or a non-terminating loop due to integer overflow in the factorial calculation logic when applications evaluate untrusted expressions. This issue is fixed in version 6.1.1.
- Product
- ncalc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to impCVE-2026-14499 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate prCVE-2026-58598 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted inputCVE-2026-38755 · Other software · BusyBox · reported by MITRELow 2.9
A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
- Product
- BusyBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbusybox.netlists.busybox.net
Jul 15, 2026A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a craftedCVE-2026-38752 · Other software · BusyBox · reported by MITRELow 2.9
A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
- Product
- BusyBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbusybox.netlists.busybox.net
Jul 15, 2026LightRAG provides simple and fast retrieval-augmented generation.CVE-2026-61740 · Other software · HKUDS · reported by GitHubCritical 9.3
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset, X-API-Key protection can be bypassed because lightrag/api/auth.py falls back to a hardcoded DEFAULT_TOKEN_SECRET, /auth-status and /login can mint guest JWTs, and combined_dependency in lightrag/api/utils_api.py accepts a valid guest token before checking the API key. A remote unauthenticated attacker can call endpoints guarded by combined_auth, including document read, upload, deletion, graph mutation, and query endpoints. This vulnerability is fixed in 1.5.4.
- Product
- LightRAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026LightRAG provides simple and fast retrieval-augmented generation.CVE-2026-61736 · Other software · HKUDS · reported by GitHubCritical 9.3
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.
- Product
- LightRAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.CVE-2026-50650 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.
- Product
- .NET 8.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.CVE-2026-47303 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- Product
- .NET 10.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.CVE-2026-47301 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Configuration Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.CVE-2026-47300 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- Product
- .NET 10.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privilegeCVE-2026-15637 · Other software · Devolutions · reported by security@devolutions.netHigh 7.5
Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.CVE-2026-58637 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-58634 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 26H1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-58633 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 26H1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.CVE-2026-58632 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.CVE-2026-58629 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.CVE-2026-58619 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.CVE-2026-58617 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft 365 Copilot for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-58613 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comtalosintelligence.com
Jul 14, 2026Heap-based buffer overflow in Universal Plug and Play (upnp.dll) allows an authorized attacker to elevate privileges locally.CVE-2026-58547 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Heap-based buffer overflow in Universal Plug and Play (upnp.dll) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-58544 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.