Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,161 results · page 33 of 304
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45753 · Other software · symfony · reported by GitHubLow 2.1
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes() omits URL-valued attributes including action, formaction, poster, and cite, so configurations that admit those attributes can leave javascript: URIs unsanitized and enable XSS when the resulting HTML is rendered or a victim submits a form or clicks a button. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45305 · Other software · symfony · reported by GitHubHigh 8.7
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45304 · Other software · symfony · reported by GitHubHigh 8.7
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structure and exhaust memory. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45133 · Other software · symfony · reported by GitHubHigh 8.2
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45075 · Other software · symfony · reported by GitHubHigh 8.3
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45073 · Other software · symfony · reported by GitHubMedium 6.3
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion scope. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45072 · Other software · symfony · reported by GitHubLow 2
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler file_excerpt Twig filter escapes PHP files through highlight_string() but interpolates lines from non-PHP files directly into <code> elements, allowing stored XSS against a developer who opens an attacker-written file such as var/log/dev.log in the profiler. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45070 · Other software · symfony · reported by GitHubMedium 6.3
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Mime\Header\ParameterizedHeader validates and encodes parameter values but emits parameter names verbatim, allowing a caller that derives a parameter name from untrusted input to include CRLF or other non-token bytes and inject additional headers into rendered structured mail headers such as Content-Type or Content-Disposition. This issue is reported as fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45069 · Other software · symfony · reported by GitHubHigh 8.8
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(), so a validly signed JWT that omitted those claims could pass verification. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45064 · Other software · symfony · reported by GitHubLow 2.3
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse() passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized content to display a link destination that visually differs from the actual destination and enabling phishing-style visual spoofing. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45063 · Other software · symfony · reported by GitHubCritical 9.1
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER['SSL_CLIENT_S_DN'] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use after free in Windows Application Model allows an authorized attacker to elevate privileges locally.CVE-2026-50331 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Application Model allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45756 · Other software · symfony · reported by GitHubHigh 8.2
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match() and search() filter patterns directly into preg_match() without a length cap, i-regexp restriction, or bounded backtracking, allowing catastrophic-backtracking expressions to pin worker CPU and cause denial of service. This issue is fixed in versions 7.4.12 and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45077 · Other software · symfony · reported by GitHubHigh 8.3
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 by default and processes each received frame with unserialize(base64_decode($message)) without authentication, integrity checks, or an allowed_classes allowlist, allowing any reachable host to submit attacker-chosen serialized PHP payloads that can crash the listener and may trigger object-injection gadget effects. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45074 · Other software · symfony · reported by GitHubHigh 7.6
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45066 · Other software · symfony · reported by GitHubLow 2.3
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts() or allowMediaHosts() because UrlSanitizer::parse() follows RFC 3986 while browsers follow WHATWG URL parsing, and because <area href> is checked against the media policy rather than the link policy. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-45065 · Other software · symfony · reported by GitHubLow 2.3
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator validates route parameters against a pattern built as ^ plus the raw requirement plus $; with ungrouped alternations, middle alternatives match as unanchored substrings, allowing a value such as //evil.com to satisfy a common locale requirement and generate a protocol-relative off-site URL. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API.CVE-2026-15389 · Other software · Sesame Time · reported by cve-coordination@incibe.esHigh 8.7
A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. The flaw lies in the fact that the system uses the session identifier (USID) as the sole validation mechanism, without verifying whether that identifier legitimately belongs to the user making the request. As a result, an attacker who obtains a valid USID can impersonate a victim’s session and access their confidential information, including emails, user IDs, roles and corporate data. This vulnerability is exacerbated by poor session lifecycle management: new logins generate additional USIDs without revoking the previous ones, allowing multiple active sessions to coexist and thereby expanding the attack surface.
- Product
- Sesame Time
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing the backend database.CVE-2026-44769 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.5
SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability of the application.
- Product
- SAP S/4HANA Project Management (PPM-PRO)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security PolicCVE-2026-44768 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.1
SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (CSP) configuration for certain restrictive directives. This vulnerability has a low impact on the integrity of the application. Confidentiality and availability are not impacted.
- Product
- SAP CRM (WebClient UI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanCVE-2026-44760 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.7
Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanitized input into the HTTP response which allows an attacker to inject and execute arbitrary JavaScript code under certain conditions. Successful exploitation could allow the attacker to steal session information, perform authenticated actions on behalf of the victim user etc. This vulnerability has low impact on confidentiality and integrity of the data and no impact on application 's availability.
- Product
- SAP NetWeaver Application Server ABAP (applications based on Business Server Pages)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling eCVE-2026-44753 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.7
SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application.
- Product
- SAP HANA Extended Application Services classic model (User Self Service)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs.CVE-2026-44752 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.2
SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data displayed in the client�s browser. This results in a high impact on confidentiality, low impact on integrity with no impact on availability of the application.
- Product
- SAP NetWeaver Application Server Java(Configuration Wizard)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lCVE-2026-44747 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.9
SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized data access, modification, or system unavailability. This has high impact on confidentiality, integrity, and availability of the application.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026HedgeDoc is an open source, real-time collaborative markdown notes application.CVE-2026-58489 · Other software · hedgedoc · reported by GitHubMedium 6.8
HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.0, the GitHub Gist export flow created an OAuth2 state value but only checked that it was present rather than validating it against the value expected for the user's session. Because the state was not properly validated, an attacker could forge a callback URL containing their own valid GitHub OAuth code. When processing the callback, HedgeDoc used the victim's logged-in session to select which note to export, but the attacker's authorization code to determine which GitHub account received it. As a result, a logged-in victim who clicked a crafted link could export their own private, protected, or limited note directly into a Gist controlled by the attacker. This issue has been fixed in version 1.11.0.
- Product
- hedgedoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026HedgeDoc is an open source, real-time, collaborative, markdown notes application.CVE-2026-58486 · Other software · hedgedoc · reported by GitHubHigh 8.3
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, HedgeDoc was vulnerable to a YAML alias bomb due to unsafe processing of the note frontmatter. HedgeDoc parsed frontmatter with js-yaml.load (js-yaml v3) via @hedgedoc/meta-marked, which resolved YAML anchor aliases. A compact malicious payload could therefore expand into a huge object structure, consuming excessive CPU. This expansion ran on every request to the publish view (/s/<shortid>) and, when placed under the opengraph key, the editor view (/<noteId>). A ten-level alias bomb could block the single Node.js event loop for roughly 235 seconds per request, causing concurrent requests to hang or drop and rendering the instance unavailable (DoS). Because the note was stored in the database, the impact survived process restarts until the note was removed. toobusy-js did not reliably mitigate the worst cases, as the event loop was saturated before the middleware could respond. This issue was fixed in version 1.11.0.
- Product
- hedgedoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026HedgeDoc is an open source, real-time, collaborative, markdown notes application.CVE-2026-58488 · Other software · hedgedoc · reported by GitHubMedium 6.9
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Versions prior to 1.11.0 allowed attackers to circumvent the rate-limiting of the /login and /register routes by spoofing IP addresses. HedgeDoc instances checked for CloudFlare's cf-connecting-ip header and used that instead of the users real IP address, if the header was present even when the request did not originate from Cloudflare. This made it possible for an attacker to spam login requests or create multiple arbitrary accounts by sending another cf-connecting-ip header every few requests. The issue has been fixed in version 1.11.0.
- Product
- hedgedoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026HedgeDoc is an open source, real-time, collaborative, markdown notes application.CVE-2026-58487 · Other software · hedgedoc · reported by GitHubMedium 5.1
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe handling of the local-part of registered email addresses, HedgeDoc was vulnerable to stored HTML Injection through its publish and slide views. An attacker could register a specially crafted email address and inject arbitrary HTML into pages viewed by other users. HedgeDoc accepted RFC 5321 quoted-string local-parts in email addresses during registration. The local-part was then reused as the user's display name without escaping and rendered into HTML in multiple places, including publish and slide views as well as the collaborative editor. An attacker could break out of an HTML attribute and inject arbitrary markup into the page. While the deployed Content-Security-Policy prevented straightforward inline JavaScript execution, the injected HTML was still sufficient to alter page content and embed attacker-controlled resources such as cross-origin iframes. This issue was fixed in version 1.11.0.
- Product
- hedgedoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py.CVE-2026-26396 · Other software · reported by MITREHigh 7.5
OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py. The input parameter “filename” is user-controllable and is concatenated into the file path to be read without proper validation, leading to a directory traversal vulnerability that may result in sensitive information disclosure.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 13, 2026Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox.CVE-2026-14906 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jul 13, 2026A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwritCVE-2026-13014 · Other software · Thales CERT · reported by psirt@thalesgroup.comCritical 9.2
A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container. This vulnerability has been names "Matryoshka Mail". Thales PSIRT acknowledges and thanks Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.
- Product
- Suspicious
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Frappe is a full-stack web application framework.CVE-2026-58503 · Other software · frappe · reported by GitHubMedium 6.9
Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the reset_password endpoint. This issue is fixed in versions 16.16.0 and 15.106.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Frappe is a full-stack web application framework.CVE-2026-55852 · Other software · frappe · reported by GitHubHigh 8.6
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.CVE-2026-52761 · Other software · owasp-modsecurity · reported by GitHubMedium 5.8
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386 architecture because snprintf uses sizeof on a char pointer rather than the length of the unicode buffer, allowing rules that use this transformation to be bypassed on i386 architecture. This issue is fixed in version 3.0.16.
- Product
- ModSecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.CVE-2026-52747 · Other software · owasp-modsecurity · reported by GitHubHigh 8.6
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGS_POST to miss payloads whose dangerous syntax depends on a line break. This issue is fixed in version 3.0.16.
- Product
- ModSecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Frappe is a full-stack web application framework.CVE-2026-49394 · Other software · frappe · reported by GitHubHigh 7.1
Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in Workspace because public workspaces did not receive the required Workspace Manager edit check. This issue is fixed in version 16.19.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Frappe is a full-stack web application framework.CVE-2026-48127 · Other software · frappe · reported by GitHubMedium 5.3
Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach files to any doctype through file-handling API endpoints such as add_attachments. This issue is fixed in versions 16.20.0 and 15.110.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Frappe is a full-stack web application framework.CVE-2026-47422 · Other software · frappe · reported by GitHubMedium 5.3
Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Frappe is a full-stack web application framework.CVE-2026-47199 · Other software · frappe · reported by GitHubLow 2.3
Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check_safe_sql_query permitted SELECT INTO OUTFILE queries, which could potentially work on self-hosted sites if database permissions are not well aligned and MySQL FILE privileges are available. This issue is fixed in versions 16.18.3 and 15.108.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Frappe is a full-stack web application framework.CVE-2026-42219 · Other software · frappe · reported by GitHubMedium 6.9
Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. This issue is fixed in versions 16.19.0 and 15.109.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Frappe is a full-stack web application framework.CVE-2026-41482 · Other software · frappe · reported by GitHubHigh 7.1
Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Chrome PDF Generator. This issue is fixed in version 16.18.3.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026LangChain4j is a Java library for building LLM-powered applications on the JVM.CVE-2026-55405 · Other software · langchain4j · reported by GitHubHigh 7.6
LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys, and in MariaDB string values, directly into the query without adequate escaping. A crafted metadata key in EmbeddingSearchRequest.filter() can break out of its SQL context and inject arbitrary SQL into the statements executed by the stores' search and removeAll(Filter) operations, enabling blind data exfiltration, denial of service via sleep functions, and deletion of arbitrary rows through removeAll(Filter). This issue is fixed in langchain4j-mariadb and langchain4j-pgvector versions 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26.
- Product
- langchain4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege.CVE-2026-21055 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 8.5
Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege.
- Product
- Bixby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jul 10, 2026Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data.CVE-2026-21054 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.9
Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data.
- Product
- InputSharing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jul 10, 2026Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attackers to create arbitrary files within the application sandbox.CVE-2026-21053 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.1
Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attackers to create arbitrary files within the application sandbox.
- Product
- Samsung Email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jul 10, 2026Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1 allows local attackers to bypass the persistence configuration of the application.CVE-2026-21044 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.8
Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1 allows local attackers to bypass the persistence configuration of the application.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jul 9, 2026Langroid is a framework for building large-language-model-powered applications.CVE-2026-55615 · Other software · langroid · reported by GitHubCritical 9.2
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.5, Neo4jChatAgent passes LLM-generated Cypher queries straight to the Neo4j driver with no validation, no statement-type allowlist, and no opt-out gate. The query text is influenceable by prompt injection (direct user input or indirect content the agent reads back via RAG), so an attacker who can influence the prompt can read or destroy all graph data and, when APOC or dbms.security procedures are enabled on the server, achieve OS-command and filesystem access. This is the same defect class and threat model as the SQLChatAgent prompt-to-SQL-to-RCE issue fixed in version 0.63.0 (CVE-2026-25879); that fix did not extend to the neo4j module. Version 0.65.5 contains a fix for the neo4j module.
- Product
- langroid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Langroid is a framework for building large-language-model-powered applications.CVE-2026-54771 · Other software · langroid · reported by GitHubHigh 8.1
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.3, a Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are registered with `use=False, handle=True`. Version 0.65.3 fixes the issue.
- Product
- langroid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Langroid is a framework for building large-language-model-powered applications.CVE-2026-54769 · Other software · langroid · reported by GitHubCritical 10
Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.65.2 are vulnerable to a critical Sandbox Escape leading to Remote Code Execution (RCE) in its `TableChatAgent` and `VectorStore` capabilities. When these agents evaluate LLM-generated tool messages with `full_eval=True`, they attempt to sandbox the execution by explicitly setting `locals` to an empty dictionary `{}` inside Python's `eval()` function. However, this relies on an incomplete understanding of Python's execution model. Because `__builtins__` is not explicitly scrubbed from the `globals` dictionary mapping, Python implicitly injects all built-ins during execution, granting full access to functions like `__import__('os').system()`. Since `TableChatAgent.pandas_eval()` executes external LLM outputs natively, this bypass permits any attacker providing prompt payload to achieve unauthenticated RCE on the host system. Version 0.65.2 patches the issue.
- Product
- langroid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Langroid is a framework for building large-language-model-powered applications.CVE-2026-54760 · Other software · langroid · reported by GitHubCritical 9.3
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.1, the `SQLChatAgent` SQL-injection mitigation, with default `allow_dangerous_operations=False`, combines a raw-text regex blocklist (`_DANGEROUS_SQL_PATTERNS`) with a `sqlglot` SELECT-only statement allowlist. The blocklist entries that target callable functions require the function name to be immediately followed by `\s*\(`. PostgreSQL accepts the same call with the name separated from `(` by a quoted identifier, an inline comment, or schema qualification. These forms evade the regex, still parse as `SELECT`, and execute the same PostgreSQL function. This restores the `pg_read_file` server-side file-read primitive that the prior CVE-2026-25879 / GHSA-pmch-g965-grmr fix was meant to block: the parent advisory fixed a missing `pg_read_file` blocklist entry, while this report shows that the added regex is bypassable. Version 0.65.1 fixes the issue.
- Product
- langroid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.