Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
393,460 results · page 327 of 7870
Oct 8, 2026Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mCVE-2026-107572 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comMedium 6.5
Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the matched value's length raised to the number of wildcards, so a pattern such as '*a*a*a*b' over 800 characters took 44 seconds; and 'deleteheader' erased the fields it removed one at a time, so removing many fields of one name over a message's header cost O(N^2) (80,000 fields took 18.8 seconds). Sieve filters run on the small, shared delivery thread pool, so an account holder whose active script does this, fed a few messages they can send themselves, empties the pool and stops delivery for the whole server. The script is the account holder's own and cannot be set for another user.
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.CVE-2026-107570 · Other software · mutt · reported by cve@gitlab.comLow 2.5
heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.
- Product
- mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comopenwall.com
Oct 8, 2026@fastify/jwt is a JSON Web Token plugin for the Fastify web framework.CVE-2026-107275 · Other software · @fastify/jwt · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 6.8
@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding whitespace, is silently dropped instead of refused. On the signing path this produces a token with no expiration claim that never expires, and on the verification path a configured maxAge stops being enforced, so a token that should be rejected for age is accepted. The issue is fixed in @fastify/jwt 10.2.3, and users should upgrade to 10.2.3 or later. As a workaround, pass these options as a number of seconds, or verify that any time-span string parses to a finite value before relying on it.
- Product
- @fastify/jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Oct 8, 2026Wallet System for WooCommerce: Does not validate that a wallet transfer amount is positiveCVE-2026-93509 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.
- Product
- Wallet System for WooCommerce
- Fixed in
- 2.8.0
- What to do
- Update Wallet System for WooCommerce to 2.8.0 or newer.
Oct 8, 2026Easy Digital Downloads: Does not consult the site's user registration setting before creating a WordPress accountCVE-2026-105190 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role.
- Product
- Easy Digital Downloads
- Fixed in
- 3.7.1
- What to do
- Update Easy Digital Downloads to 3.7.1 or newer.
Oct 8, 2026Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contaiCVE-2026-104704 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 7.4
Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published, so delivery to such a host fell back to opportunistic TLS. An attacker with an active position on the network path between the server and the recipient's mail exchanger can suppress or break the STARTTLS negotiation and cause messages to be delivered in cleartext, where they can be read and modified.
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026TutorStarter: Does not respect the site's user registration setting in one of its AJAX registration handlersCVE-2026-104671 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.
- Product
- TutorStarter
- Fixed in
- 4.0.4
- What to do
- Update TutorStarter to 4.0.4 or newer.
Oct 8, 2026Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer credeCVE-2026-104660 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 7.8
Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCOM access or launch permission and calls CoInitializeSecurity with no security descriptor, so any user logged on at the console or over Remote Desktop can activate the classes in the running service; a hMailServer.Message, its Attachments and Attachment, and a hMailServer.FetchAccount created this way carry a credential that never authenticated. Attachments.Add(path) and Attachment.SaveAs(path) performed no authorization check, and Message.Save/Copy and FetchAccount.AccountID/Save performed none either up to 6.3.3 and from 6.3.4 treated a holder with no credential as the server's own event-script host. Because the service does not impersonate the COM caller, Attachments.Add reads any file the service account can read and returns it, Attachment.SaveAs writes attacker-chosen bytes to any path it can write (on a LocalSystem installation, code execution as SYSTEM), Message.Save queues outbound
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6CVE-2026-104659 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 7.5
Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding. The listener, which is off by default and bound to the loopback when enabled, answered requests whatever their Host header named, and a failed sign-in with the administrator's password from the loopback was neither auto-banned nor delayed. A web page whose host name the attacker rebinds to 127.0.0.1, opened in a browser on the server, can therefore send authenticated requests to the listener, read the answers and try administrator passwords at full speed until one is accepted, giving the attacker full administrative control of the mail server.
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileCVE-2026-104658 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 7.8
The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit to stop before reading the service account's files. An attacker who already runs code as the hmailserver service account, for example through another flaw in the mail server, can therefore have arbitrary code executed as root, on any Linux installation where the live update's path unit is active - the default for the project's .deb and .rpm packages - and on AppImage installations run under that unit.
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely anCVE-2026-103649 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 7.5
Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery (denial of service). The server set its socket timeouts in the form Windows takes, which Linux refuses, and its HTTPS clients read without a deadline, so a peer that accepts a connection and then sends nothing held the waiting thread for as long as the connection stayed open. The MTA-STS policy fetch, enabled by default, is made during outbound delivery to mta-sts.<recipient domain>, so anyone who can make the server deliver mail to a domain they control - for example as the envelope sender of a message that bounces - can hold delivery threads until outbound delivery stops. The same flaw affects the DANE TLSA query, the OAuth2 token request, the ACME client, and the ManageSieve and metrics listeners, which a silent client stops from serving anyone else. Windows builds are not affected.
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to ruCVE-2026-103647 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 8
Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message (from 6.3.2) or an OpenPGP message (from 6.3.4) in the browser, it offered each decrypted attachment as a blob URL of the media type the message declared for it. A click saved the file, but if the user opened the attachment in a new tab, a part declared as text/html was rendered as a document of the webmail's origin and its script could read the mailbox, send mail and change the account through the REST API. The webmail is served only when the REST API is enabled, which it is not by default.
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Airwallex Online Payments Gateway: Does not verify that an incoming payment notification genuinely comes from the payment providerCVE-2026-103517 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.
- Product
- Airwallex Online Payments Gateway
- Fixed in
- 1.36.0
- What to do
- Update Airwallex Online Payments Gateway to 1.36.0 or newer.
Oct 8, 2026Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6.0CVE-2026-103011 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comMedium 6.5
Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user to cause a denial of service (service crash), and possibly other unspecified impact. In 6.3.4 and 6.3.5, where the self-service REST API is enabled (it is off by default), the user does this remotely by adding a fetch account whose password is 129 to 247 characters long and not a multiple of 8, and then requesting their personal data export (GET /api/v1/me/export.zip), which encrypts that password with the legacy scheme. The same flaw is reachable on Windows by any local interactive user with no hMailServer credentials, through the COM method Utilities.BlowfishEncrypt, which checked no authentication. It is also reachable by every stored-secret write when ProtectStoredSecretsWithDPAPI is set to 0. For such a length, the routine's padding loop writes up to 7 zero bytes 2 to 232 bytes past the end of its 255-byte heap buffer. The ciphertext it returns is still correct.
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3CVE-2026-103010 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 7.8
Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows allows a local interactive user with no hMailServer credentials to write bytes of their choosing past the end of a 255-byte heap buffer in the hMailServer service process, which runs as LocalSystem by default. The user does this by passing a long hexadecimal string to the COM method Utilities.BlowfishDecrypt, which checked no authentication. The routine converted hexadecimal input of any length into a fixed 255-byte buffer before decrypting it in place. The result is a denial of service (service crash), and possibly code execution with the privileges of the service account.
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.CVE-2026-107510 · Other software · Infoblox · reported by f84ca5ce-fbe7-4668-8724-994599108a02Critical 9.1
An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.
- Product
- NIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaumlayer.comsupport.infoblox.com
Oct 8, 2026In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto API URI anCVE-2026-107503 · Other software · Eclipse Ditto · reported by emo@eclipse.orgHigh 7.1
In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto API URI and the OpenID Connect (OIDC) provider settings, from an arbitrary cross-origin URL supplied in the environmentsURL query parameter. It adopts this configuration without user confirmation and persists it in the browser's localStorage. A crafted link can therefore set an attacker-controlled OIDC authority with autoSso enabled. The UI then automatically starts a login at the genuine identity provider but exchanges the returned authorization code together with its PKCE code_verifier at an attacker-controlled token endpoint. This lets the attacker redeem the code for the victim's access and refresh tokens. Alternatively, an attacker-controlled api_uri causes the UI to send the victim's bearer token or Basic credentials to the attacker. Because the configuration is persisted, later visits to the UI without the crafted link repeat the token theft. In versions 3.9.0 to 3.9.7, the Swagger UI OIDC integration of the Helm chart and the Docker Compose deployment is affected in the same way, but requires the user to start the login. The i
- Product
- Ditto Explorer UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeclipse.deveclipse.dev
Oct 8, 2026Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proCVE-2026-89191 · Other software · SQLView · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Medium 6.8
Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject and store malicious scripts that execute in the browsers of affected users.
- Product
- SQLView KRIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/CVE-2026-71896 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returning user account information. As a result, an authenticated user can access account information they are not authorized to view. Successful exploitation may expose sensitive user information and facilitate account enumeration. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.
- Product
- Apache DolphinScheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 8, 2026An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administraCVE-2026-71895 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.1
An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the Kubernetes API outside DolphinScheduler. The impact depends on the permissions granted to the disclosed credentials. If the kubeconfig provides cluster-admin or broadly privileged service-account access, an attacker may read Kubernetes Secrets, create pods, and establish persistent access to the cluster. This issue affects Apache DolphinScheduler: from 3.2.0 before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.
- Product
- Apache DolphinScheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 8, 2026An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access CVE-2026-71183 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.1
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls and return sensitive connection information, including data source passwords. As a result, an authenticated user without permission to access a data source can retrieve its connection details and credentials. Successful exploitation exposes sensitive data source information and may enable unauthorized access to the underlying databases using the disclosed credentials. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.
- Product
- Apache DolphinScheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 8, 2026An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to acceCVE-2026-66087 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the * /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop * /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.
- Product
- Apache DolphinScheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 8, 2026An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to acCVE-2026-66084 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint. The endpoint fails to verify that the task definition identified by code belongs to the project specified by projectCode. An authenticated user can supply the code of a project they are authorized to access together with a task definition code from another project, bypassing project access restrictions and modifying the target task definition and its upstream dependencies. This vulnerability can compromise workflow integrity and disrupt task execution in unauthorized projects.This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.
- Product
- Apache DolphinScheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 8, 2026An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow dCVE-2026-66082 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against the supplied projectCode but fail to verify that the target resource belongs to that project. An authenticated user with the required permissions in one project can supply that project's code together with a resource identifier from another project, bypassing the target project's access restrictions. The affected endpoints include: * POST /projects/{projectCode}/schedules/{id}/online and /offline: Activate or deactivate workflow schedules in another project. * POST /projects/{projectCode}/workflow-definition/{code}/release: Change the ONLINE/OFFLINE state of workflow definitions in another project. Successful exploitation allows users to alter workflow availability and interfere with task execution in projects they are not authorized to access. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.
- Product
- Apache DolphinScheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 8, 2026A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses CVE-2026-4894 · Other software · Frappe Technologies · reported by cve-coordination@incibe.esMedium 6.9
A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.account.signup endpoint. The vulnerability occurs when an unauthenticated remote attacker adds more than one email address. The service processes the entire value as a valid list of recipients and sends the OTP code to all addresses without proper validation of all added emails (only one of them needs to be valid). Exploiting this vulnerability would allow an attacker to: * Obtain the authentication OTP; * Impersonate someone else in the registration process; * Register accounts using other people's email addresses without access to the mailbox; * Indirectly confirm the existence of already registered email addresses.
- Product
- Frappe Technologies
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endCVE-2026-12260 · Other software · NetBoard CRM · reported by cve-coordination@incibe.esCritical 10
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.
- Product
- NetBoard CRM Demo Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands aCVE-2026-105110 · Other software · Iskratel · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.3
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
- Product
- Innbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.CVE-2026-93699 · Websites & servers · reported by support@hackerone.comHigh 8.5
Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026A flaw was found in flatpak-builder.CVE-2026-107466 · Other software · Red Hat · reported by Red HatMedium 6.1
A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. As a result, sensitive host files accessible to the build process can be read and incorporated into the build artifacts.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 8, 2026In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored managemeCVE-2026-87428 · Other software · Brocade · reported by sirt@brocade.comHigh 8.4
In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration CVE-2026-87426 · Other software · Brocade · reported by sirt@brocade.comMedium 5.3
An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS (FOS) switches. This results in the unauthorized disclosure of the customer's SAN fabric management topology and switch connectivity attributes.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0.CVE-2026-87425 · Other software · Brocade · reported by sirt@brocade.comHigh 7.6
An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-in-the-Middle (MITM) attacks against outbound communications with managed switches and peer nodes.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deploCVE-2026-87424 · Other software · Brocade · reported by sirt@brocade.comHigh 8.6
A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal seCVE-2026-85490 · Other software · Brocade · reported by sirt@brocade.comHigh 7.7
When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can leverage this flaw to write arbitrary files to restricted locations on the underlying host, potentially leading to remote code execution.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026An authentication flaw exists in the Brocade ASCG administrative management service component.CVE-2026-85489 · Other software · Brocade · reported by sirt@brocade.comHigh 8.7
An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer.CVE-2026-85488 · Other software · Brocade · reported by sirt@brocade.comHigh 7
Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance (OVA) deployments, where default configuration settings remain in place.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0.CVE-2026-85487 · Other software · Brocade · reported by sirt@brocade.comHigh 8.6
A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion operations.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation.CVE-2026-85486 · Other software · Brocade · reported by sirt@brocade.comHigh 8.6
Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code on the server and take control of the application.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0.CVE-2026-85423 · Other software · Brocade · reported by sirt@brocade.comHigh 8.6
A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the application to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning the appliance into an unauthenticated proxy or execution vector.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secureCVE-2026-85422 · Other software · Brocade · reported by sirt@brocade.comHigh 8.4
A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored management credentials or craft forged administrative synchronization messages.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0.CVE-2026-85421 · Other software · Brocade · reported by sirt@brocade.comHigh 8.7
A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states, and modify system configurations, leading to a complete compromise of the streaming service control plane.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Bricksforge: Unauthenticated arbitrary file uploadCVE-2026-85097 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.
- Product
- Bricksforge
- Affected
- up to 3.1.8.9
- What to do
- Affects up to 3.1.8.9. Update Bricksforge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbricksforge.iowordfence.com
Oct 8, 2026Track Orders for WooCommerce: Does not verify ownership of an order before returning its billing detailsCVE-2026-94275 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's email address.
- Product
- Track Orders for WooCommerce
- Fixed in
- 1.2.7
- What to do
- Update Track Orders for WooCommerce to 1.2.7 or newer.
Oct 8, 2026SMS Alert: Does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbersCVE-2026-94258 · WordPress plugins & themes · reported by WPScanLow 2.7
The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the SMS Alert WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site.
- Product
- SMS Alert
- Fixed in
- 4.0.1
- What to do
- Update SMS Alert to 4.0.1 or newer.
Oct 8, 2026Wallet System for WooCommerce: Does not verify that the wallet account named in a withdrawal submission belongs to the user making itCVE-2026-94246 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount and a payout destination of their choosing, and to indefinitely prevent that user from submitting withdrawals of their own.
- Product
- Wallet System for WooCommerce
- Fixed in
- 2.8.0
- What to do
- Update Wallet System for WooCommerce to 2.8.0 or newer.
Oct 8, 2026Wallet System for WooCommerce: Does not verify that the user submitting a wallet transfer owns the wallet being debitedCVE-2026-94245 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.
- Product
- Wallet System for WooCommerce
- Fixed in
- 2.8.0
- What to do
- Update Wallet System for WooCommerce to 2.8.0 or newer.
Oct 8, 2026Wallet System for WooCommerce: Does not perform any capability checkCVE-2026-94244 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user, such as a subscriber, to disclose all users' names, email addresses, roles, transaction amounts, payment methods and dates.
- Product
- Wallet System for WooCommerce
- Fixed in
- 2.8.0
- What to do
- Update Wallet System for WooCommerce to 2.8.0 or newer.
Oct 8, 2026BackWPup: Does not properly restrict the destination path of files extracted during a backup restoreCVE-2026-86828 · WordPress plugins & themes · reported by WPScanMedium 6.6
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.
- Product
- BackWPup
- Fixed in
- 5.7.7
- What to do
- Update BackWPup to 5.7.7 or newer.
Oct 8, 2026BackWPup: Does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatchCVE-2026-86827 · WordPress plugins & themes · reported by WPScanMedium 5.3
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.
- Product
- BackWPup
- Fixed in
- 5.7.7
- What to do
- Update BackWPup to 5.7.7 or newer.
Oct 8, 2026BackWPup: Does not properly restrict web access to the working directory it uses during backup restoresCVE-2026-86826 · WordPress plugins & themes · reported by WPScanMedium 5.9
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.
- Product
- BackWPup
- Fixed in
- 5.7.7
- What to do
- Update BackWPup to 5.7.7 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.