Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,286 results · page 36 of 346
Aug 24, 2026Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability.CVE-2026-78685 · Other software · Le-yan · reported by twcert@cert.org.twHigh 8.6
Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page.
- Product
- Medical Practice Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 24, 2026Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions tCVE-2026-72695 · Other software · getgrav · reported by VulnCheckHigh 7.1
Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths containing ../ sequences that are passed to unlink(), enabling deletion of files outside the intended media storage directory.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 24, 2026Wagtail is an open source content management system built on Django.CVE-2026-55468 · Other software · wagtail · reported by GitHubMedium 4.3
Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2026Combodo iTop is a web-based IT service management tool.CVE-2026-40877 · Other software · Combodo · reported by GitHubHigh 8.7
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2026Combodo iTop is a web-based IT service management tool.CVE-2026-39975 · Other software · Combodo · reported by GitHubCritical 9.4
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2026Combodo iTop is a web-based IT service management tool.CVE-2026-30864 · Other software · Combodo · reported by GitHubHigh 8.9
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting (XSS) in the dashboard revert functionality. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 20264MOSAn developed by 4MOSAn Security Technology Co., Ltd.CVE-2026-78212 · Other software · 4MOSAn Security Technology · reported by twcert@cert.org.twHigh 8.7
4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files.
- Product
- 4MOSAn Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 22, 2026A flaw has been found in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5.CVE-2026-78057 · Other software · sambitraj · reported by VulDBLow 2.1
A flaw has been found in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This affects an unknown part of the component Management Mutation Handler. This manipulation of the argument roll_no/name/father_name/class/mobile/email/password/remark causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Student-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5.CVE-2026-78056 · Other software · sambitraj · reported by VulDBLow 2.1
A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is some unknown functionality of the component Dashboard. The manipulation of the argument roll_no/teacher_name results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Student-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file createCVE-2026-34949 · Other software · Combodo · reported by GitHubMedium 6.5
Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-34948 · Other software · Combodo · reported by GitHubHigh 7.7
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites.CVE-2026-53468 · Other software · typemill · reported by GitHubMedium 4.6
Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields (`og:title` and `og:description`). An authenticated user with permission to modify page metadata can inject arbitrary HTML attributes into generated `<meta>` tags due to missing output encoding. Under certain browser or DOM interaction scenarios, this may lead to stored cross-site scripting (XSS). Version 2.23.0 fixes the issue.
- Product
- typemill
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-34836 · Other software · Combodo · reported by GitHubMedium 6.5
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-34741 · Other software · Combodo · reported by GitHubHigh 8.6
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-33333 · Other software · Combodo · reported by GitHubLow 3.5
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-33240 · Other software · Combodo · reported by GitHubHigh 8.8
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-33047 · Other software · Combodo · reported by GitHubMedium 4.3
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-31936 · Other software · Combodo · reported by GitHubHigh 8.8
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Keystone is a content management system for Node.js.CVE-2026-63421 · Other software · keystonejs · reported by GitHubHigh 7.5
Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return more records than the developer intended, potentially exhausting service resources. This issue is fixed in version 6.5.3.
- Product
- keystone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-31880 · Other software · Combodo · reported by GitHubHigh 8
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-31803 · Other software · Combodo · reported by GitHubHigh 8
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-30890 · Other software · Combodo · reported by GitHubHigh 8
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-30865 · Other software · Combodo · reported by GitHubHigh 7.1
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-30826 · Other software · Combodo · reported by GitHubHigh 8
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-30866 · Other software · Combodo · reported by GitHubHigh 7.5
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-30819 · Other software · Combodo · reported by GitHubHigh 7.3
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with the parameter dashboard_id in /pages/ajax.render.php. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-27490 · Other software · Combodo · reported by GitHubHigh 7.5
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-27463 · Other software · Combodo · reported by GitHubMedium 5.3
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Combodo iTop is a web based IT service management tool.CVE-2026-27462 · Other software · Combodo · reported by GitHubHigh 7.5
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Unleash is an open-source feature management platform.CVE-2026-63466 · Other software · Unleash · reported by GitHubMedium 4.1
Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3.
- Product
- unleash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Unleash is an open-source feature management platform.CVE-2026-63462 · Other software · Unleash · reported by GitHubHigh 7.5
Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.
- Product
- unleash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Unleash is an open-source feature management platform.CVE-2026-63004 · Other software · Unleash · reported by GitHubMedium 5.5
Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry in src/lib/addons/addon.ts without restricting loopback, link-local, private, or cloud metadata addresses. An authenticated actor with the root CREATE_ADDON or UPDATE_ADDON permission can cause the server to send requests from inside its network boundary, use integration event status as a blind probing oracle, forward Authorization, customHeaders, or DD-API-KEY values to an attacker-observed host, and deliver the feature-event JSON body to internal services. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.
- Product
- unleash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-50278 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.5
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a `CIccEmbedIO::Read8()` size_t underflow. The issue arises due to an embedded-profile read defect when parsing ICC profiles containing `icSigEmbeddedV5ProfileTag` data with `icSigEmbeddedProfileType` payloads. Version 2.3.2.1 patches the issue. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable floCVE-2026-59799 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026AI Engine: Does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operationsCVE-2026-75796 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.
- Product
- AI Engine
- Fixed in
- 3.6.1
- What to do
- Update AI Engine to 3.6.1 or newer.
Aug 20, 2026External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write CVE-2026-76158 · Other software · Datiphy Inc. · reported by ART@zuso.aiCritical 9.3
External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences.
- Product
- Data Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticatedCVE-2026-76157 · Other software · Datiphy Inc. · reported by ART@zuso.aiHigh 8.8
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory.
- Product
- Data Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitraryCVE-2026-76156 · Other software · Datiphy Inc. · reported by ART@zuso.aiCritical 9.4
OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root.
- Product
- Data Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the managementCVE-2026-76155 · Other software · Datiphy Inc. · reported by ART@zuso.aiCritical 9.3
Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials.
- Product
- Data Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Kerberos Agent is an open source video (surveillance) management agent.CVE-2026-50192 · Other software · kerberos-io · reported by GitHubMedium 6.9
Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey` request headers to the operator-configured Hub URL (`config.HubURI`). The HTTP client used (`&http.Client{}` in `UploadKerberosHub`) is constructed without a `CheckRedirect` policy, so it follows HTTP redirects automatically. Go's `net/http` strips only sensitive headers (`Authorization`, `Cookie`, `WWW-Authenticate`) on a cross-host redirect; it does not strip custom headers such as `X-Kerberos-Hub-PrivateKey`. As a result, if the configured `HubURI` returns a cross-host 30x redirect, the Hub private key is forwarded verbatim to the redirect target, disclosing the credential to an unintended third party. Version 3.6.26 fixes the issue by implementing the `CheckRedirect` strip plus a cross-host regression test is provided to the maintainer through the advisory's private temporary fork.
- Product
- agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper privilege management.CVE-2026-17145 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper privilege management.
- Product
- AIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper privilege management.CVE-2026-16997 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper privilege management.
- Product
- AIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management.CVE-2026-16937 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management.
- Product
- AIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM).CVE-2026-73137 · Other software · Red Hat · reported by Red HatHigh 7.7
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `GetSecret()` function in the HelmRelease controller to fetch sensitive credentials from any namespace, which are then sent to an attacker-controlled Helm repository. This can lead to the exfiltration of credentials from arbitrary namespace Secrets, resulting in information disclosure.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 20, 2026A flaw was found in the multicloud-operators-subscription component.CVE-2026-67567 · Other software · Red Hat · reported by Red HatCritical 9.9
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper validation. This enables the tenant to deploy arbitrary resources across the entire cluster, leading to a significant security compromise.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 20, 2026django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django.CVE-2026-75526 · Other software · django-cms · reported by GitHubMedium 4.4
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor’s browser, and settings.DEBUG does not prevent the custom heading from rendering. The fix uses format_html to escape the message before safe placeholder output is returned. This issue is fixed in versions 5.0.9.
- Product
- django-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026A flaw was found in Lighthouse.CVE-2026-66788 · Other software · Red Hat · reported by Red HatCritical 9.9
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 20, 2026A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes.CVE-2026-66787 · Other software · Red Hat · reported by Red HatHigh 8.7
A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 20, 2026A flaw was found in Submariner.CVE-2026-66785 · Other software · Red Hat · reported by Red HatHigh 8.7
A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious cluster, enabling it to declare arbitrary network ranges. Consequently, all network traffic intended for these arbitrary ranges from peer clusters will be rerouted through the attacker's tunnel, potentially leading to unauthorized information disclosure or network disruption.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 20, 2026django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django.CVE-2026-63003 · Other software · django-cms · reported by GitHubMedium 6.5
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9.
- Product
- django-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.