Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29,210 results · page 38 of 585
Sep 18, 2026PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptograpCVE-2026-81946 · Other software · PLANET Technology Corp. · reported by VulnCheckMedium 6.7
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access password.
- Product
- PLANET IGS-5225-8P2T4S V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordplanet.com.twvulncheck.com
Sep 18, 2026PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in theCVE-2026-81945 · Other software · PLANET Technology Corp. · reported by VulnCheckHigh 7.5
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web server. Insufficient bounds checking on data copied into a stack buffer allows a remote administrator to cause a denial of service or potentially execute arbitrary code on the underlying operating system.
- Product
- PLANET IGS-5225-8P2T4S V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordplanet.com.twvulncheck.com
Sep 18, 2026PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in theCVE-2026-81944 · Other software · PLANET Technology Corp. · reported by VulnCheckHigh 7.7
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web server. Insufficient bounds checking on data copied into a stack buffer allows a remote authenticated attacker to cause a denial of service or potentially execute arbitrary code on the underlying operating system.
- Product
- PLANET IGS-5225-8P2T4S V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordplanet.com.twvulncheck.com
Sep 18, 2026PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the emCVE-2026-81943 · Other software · PLANET Technology Corp. · reported by VulnCheckHigh 8.4
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the embedded software. An attacker with privileged access to the device can enable this debug mode to execute arbitrary code on the underlying operating system and gain root-level access.
- Product
- PLANET IGS-5225-8P2T4S V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordplanet.com.twvulncheck.com
Sep 18, 2026PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerabilitCVE-2026-81942 · Other software · PLANET Technology Corp. · reported by VulnCheckHigh 8.7
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system() without sufficient filtering, allowing a remote authenticated attacker to execute arbitrary commands on the underlying operating system and escalate privileges to root.
- Product
- PLANET IGS-5225-8P2T4S V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordplanet.com.twvulncheck.com
Sep 18, 2026kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads.CVE-2026-61682 · Other software · kcp-dev · reported by GitHubCritical 9.9
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.
- Product
- kcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information causedCVE-2025-33147 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication.
- Product
- Cognos Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026A flaw was found in the multicluster-observability-addon.CVE-2026-93685 · Other software · Red Hat · reported by Red HatMedium 5.4
A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and command-line details, after completing a basic encrypted connection. This vulnerability does not enable direct remote code execution.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 18, 2026A flaw was found in Netty netty-codec-smtp.CVE-2026-93576 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP commands. This can lead to SMTP command smuggling, allowing for unauthorized email relay or spoofing of sender/recipient addresses. While the impact is significant, the real-world exploitability is considered lower as applications typically do not place user-controlled data in the command-name field.
- Product
- Red Hat build of Apache Camel for Spring Boot 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 18, 2026A flaw was found in Netty's HTTP/1.1 decoder.CVE-2026-93573 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.
- Product
- Red Hat Build of Debezium 3.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 18, 2026A flaw was found in Netty.CVE-2026-93569 · Other software · Red Hat · reported by Red HatHigh 8.2
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.
- Product
- Red Hat Build of Apache Camel 3.33.3.SP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 18, 2026A flaw was found in Netty.CVE-2026-93568 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.
- Product
- Red Hat Build of Apache Camel 3.33.3.SP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 18, 2026A flaw was found in Netty's HTTP/2 codec.CVE-2026-93567 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.
- Product
- Red Hat Build of Apache Camel 3.33.3.SP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 18, 2026A flaw was found in Netty.CVE-2026-93566 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
- Product
- Red Hat Build of Debezium 3.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 18, 2026A flaw was found in Netty RtspDecoder.CVE-2026-93565 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.
- Product
- Red Hat Build of Apache Camel 3.33.3.SP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 18, 2026A flaw was found in Netty.CVE-2026-93564 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.
- Product
- Red Hat Build of Apache Camel 3.33.3.SP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 18, 2026A flaw was found in Netty's WebSocketServerExtensionHandler.CVE-2026-93558 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.
- Product
- Red Hat Build of Apache Camel 3.33.3.SP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 18, 2026A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare CVE-2026-25684 · Other software · Zscaler · reported by cve@zscaler.comMedium 4.4
A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances.
- Product
- ZIA File Type Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules (do not answer an ICMPv6 error with aCVE-2026-16515 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgMedium 4.7
net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules (do not answer an ICMPv6 error with an ICMPv6 error). It did not check whether the triggering packet's source address identifies a single node (rule e.6) or whether the packet was sent to a multicast destination (rule e.3, whose only exceptions are Packet Too Big and Parameter Problem Code 2). Of the five call sites, only the port-unreachable path in subsys/net/ip/connection.c carried an equivalent guard of its own; the extension-header, unknown-next-header and fragmentation paths in subsys/net/ip/ipv6.c and subsys/net/ip/ipv6_fragment.c had none. An unauthenticated attacker with access to the same link can exploit this in two ways. Sending a single IPv6 packet to the link-local all-nodes group ff02::1 carrying an unrecognized next-header value, with the source address spoofed to a chosen victim, causes every Zephyr node on the link to emit an ICMPv6 Parameter Problem message to that victim — a reflector with an amplification factor equal to the number of nodes. Alternatively, sending a unicast packet whose source address is a multicast address causes the node
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock iCVE-2026-16514 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgMedium 4.3
gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock identity against the local one. The loop bound was taken solely from the attacker-controlled wire field announce->steps_removed (accepted up to 254), never from announce->tlv.len, which is the field that states how many identities the TLV actually carries. Because path_sequence is the flexible member of the wire TLV (struct gptp_path_trace_tlv) and GPTP_ANNOUNCE() yields a raw pointer into the received packet buffer, the memcmp() inside the loop can address memory well past the end of the received frame. The stack's only length validation, GPTP_ANNOUNCE_CHECK_LEN(), requires the received gPTP payload to be exactly 68 + tlv.len bytes — so it does not constrain the loop, it guarantees the data is absent. An unauthenticated attacker on the same Ethernet segment can send a single Announce frame declaring tlv.len = 0 with steps_removed = 254; the frame passes the length check and reception path (net_gptp_recv() → gptp_handle_msg() → gptp_mi_qualify_announce()), which performs no authentication, and the loop then reads 255 entries
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() and switched on hdr->message_type without first checCVE-2026-16512 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgLow 3.1
gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() and switched on hdr->message_type without first checking that the received frame carries at least sizeof(struct gptp_hdr) (34) bytes of payload. The header accessor gptp_get_hdr() deliberately never fails for a short buffer — it returns pkt->frags->data and leaves validation to its callers — so a truncated frame produced a header pointer covering memory beyond the received data. The per-message-type checks that follow do not compensate: GPTP_VALID_LEN() reduces to len > 60 once the Ethernet header has been pulled, which is false for every fixed-size gPTP message, so GPTP_CHECK_LEN() never rejects a truncated SYNC, FOLLOWUP, PDELAY_RESP or SIGNALING message. The defect is reached by an unauthenticated peer on the same link sending an Ethernet frame with ethertype 0x88F7 to the PTP multicast address on an interface configured as a gPTP port, with CONFIG_NET_GPTP enabled. Because conformant Ethernet pads frames to 60 bytes, a payload shorter than 34 bytes generally requires a link that can deliver sub-minimum frames — for example the native_sim TAP driver (drivers/ethernet/eth_
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026A flaw was found in the Netty STOMP codec.CVE-2026-93560 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service (DoS) by exhausting memory and CPU resources.
- Product
- Red Hat build of Apache Camel for Spring Boot 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 18, 2026NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read.CVE-2026-88623 · Other software · reported by MITREHigh 7.5
NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen() is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename() of the URL. This operation requires no authentication.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnuuo.comgist.github.com
Sep 18, 2026NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php.CVE-2026-88622 · Other software · reported by MITREHigh 8.8
NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnuuo.comgist.github.com
Sep 18, 2026A flaw was found in Netty's HTTP/2 HpackEncoder.CVE-2026-93492 · Other software · Red Hat · reported by Red HatMedium 5.3
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).
- Product
- Red Hat Build of Debezium 3.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 18, 2026A flaw was found in Netty's HttpServerCodec.CVE-2026-93491 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.
- Product
- Red Hat Build of Apache Camel 3.33.3.SP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 18, 2026A flaw was found in Netty.CVE-2026-93488 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.
- Product
- Red Hat Build of Apache Camel 3.33.3.SP2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 18, 2026An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a speCVE-2026-28199 · Other software · Cohesity · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 4.8
An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential material stored on the appliance.
- Product
- NetBackup Flex OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a prCVE-2026-28198 · Other software · Cohesity · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.4
An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful exploitation grants the attacker an unrestricted root shell with full control over the Flex appliance host and all hosted containers, completely compromising confidentiality, integrity, and availability.
- Product
- NetBackup Flex OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administratCVE-2026-28197 · Other software · Cohesity · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.4
An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful exploitation grants the attacker unrestricted control over the Flex appliance host and all hosted containers, fully compromising confidentiality, integrity, and availability.
- Product
- NetBackup Flex OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client.CVE-2026-93578 · Other software · Red Hat · reported by Red HatMedium 5.9
A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP responses for revoked certificates. This bypasses certificate revocation checks, allowing applications using Netty's OCSP Client to accept certificates that should have been revoked, leading to an authorization bypass.
- Product
- Red Hat build of Apache Camel for Spring Boot 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 18, 2026A flaw was found in Netty's MqttDecoder.CVE-2026-93575 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits. This leads to excessive memory and CPU consumption, resulting in a denial of service (DoS) due to an OutOfMemoryError.
- Product
- Red Hat AMQ Broker 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 18, 2026A flaw was found in Netty's `RedisArrayAggregator` component.CVE-2026-93572 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `RedisArrayAggregator` to eagerly preallocate a large amount of heap memory, leading to heap memory exhaustion and a Denial of Service (DoS) for applications using `RedisDecoder` with `RedisArrayAggregator` on untrusted traffic.
- Product
- Red Hat build of Apache Camel for Spring Boot 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 18, 2026A flaw was found in Netty's `SmtpResponseDecoder` component.CVE-2026-93563 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vulnerability leads to unbounded memory accumulation within the client's Java Virtual Machine (JVM) heap, causing an `OutOfMemoryError` and a denial of service (DoS) due to a process crash.
- Product
- Red Hat build of Apache Camel for Spring Boot 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 18, 2026A flaw was found in io.netty/netty-codec-memcache.CVE-2026-93561 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted response. This can lead to frame desynchronization and response smuggling, where one client's data may be inadvertently exposed to another client's response stream in proxy or cache environments.
- Product
- Red Hat build of Apache Camel for Spring Boot 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 18, 2026An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login procesCVE-2026-15579 · Other software · Moxa · reported by psirt@moxa.comHigh 8.8
An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing. This may allow a remote attacker to submit a specially crafted overly long input, triggering a buffer overflow that can cause the authentication process to crash and result in a Denial of Service (DoS) attack.
- Product
- TN-4500B Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026A flaw was found in Netty's StompSubframeDecoder component.CVE-2026-93494 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec.
- Product
- Red Hat build of Apache Camel for Spring Boot 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 18, 2026A flaw was found in Netty's `netty-handler-ssl-ocsp` component.CVE-2026-93493 · Other software · Red Hat · reported by Red HatMedium 5.9
A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol (OCSP) response that omits the optional `nextUpdate` field. This omission causes the OCSP validation to be silently skipped, leading to applications proceeding with an unvalidated certificate. This can result in a bypass of security controls where certificate validation is expected.
- Product
- Red Hat build of Apache Camel for Spring Boot 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 17, 2026Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.CVE-2026-85887 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.7
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.
- Product
- Microsoft 365 Copilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.CVE-2026-85878 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
- Product
- Azure HorizonDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.CVE-2026-69843 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.CVE-2026-62874 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Billing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.CVE-2026-85917 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure AI Foundry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.CVE-2026-85889 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure AI Foundry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.CVE-2026-83944 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Logic Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.CVE-2026-77903 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Dataverse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a networkCVE-2026-70009 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure ARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.CVE-2026-69865 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Container Registry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Unintended proxy or intermediary in Azure Arc allows an authorized attacker to elevate privileges over a network.CVE-2026-69399 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Unintended proxy or intermediary in Azure Arc allows an authorized attacker to elevate privileges over a network.
- Product
- Azure ARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.CVE-2026-68791 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.6
Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.
- Product
- Azure Machine Learning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.