Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,333 results · page 39 of 147
Mar 10, 2026Insufficient verification of data authenticity in Windows App Installer allows an unauthorized attacker to perform spoofing over a network.CVE-2026-23656 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Insufficient verification of data authenticity in Windows App Installer allows an unauthorized attacker to perform spoofing over a network.
- Product
- Windows App Client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2026In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.CVE-2026-25604 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.
- Product
- Apache Airflow Providers Amazon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Mar 9, 2026The installer for Qsee Client versions 1.0.1 and prior insecurely load Dynamic Link Libraries (DLLs).CVE-2026-30896 · Other software · Qsee · reported by vultures@jpcert.or.jpHigh 8.4
The installer for Qsee Client versions 1.0.1 and prior insecurely load Dynamic Link Libraries (DLLs). When a user is directed to place some malicious DLL to the same directory and execute the affected installer, then arbitrary code may be executed with the administrative privilege.
- Product
- Qsee Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval requCVE-2026-28473 · Other software · OpenClaw · reported by VulnCheckHigh 7.2
OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval requests by sending the /approve chat command. The /approve command path invokes exec.approval.resolve through an internal privileged gateway client, bypassing the operator.approvals permission check that protects direct RPC calls.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026OpenClaw versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing authenticated gateway clients to write transcript data to arbitraCVE-2026-28459 · Other software · OpenClaw · reported by VulnCheckHigh 7.1
OpenClaw versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing authenticated gateway clients to write transcript data to arbitrary locations on the host filesystem. Attackers can supply a sessionFile path outside the sessions directory to create files and append data repeatedly, potentially causing configuration corruption or denial of service.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application funcCVE-2026-26418 · Other software · TCS · reported by MITREHigh 7.5
Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network.
- Product
- Cognix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reCVE-2026-26417 · Other software · TCS · reported by MITREHigh 8.1
A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests.
- Product
- Cognix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privileges across role boundaCVE-2026-26416 · Other software · TCS · reported by MITREHigh 8.8
An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privileges across role boundaries via crafted requests.
- Product
- Cognix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacking extension diverCVE-2025-13476 · Other software · Rakuten Viber · reported by cret@cert.orgCritical 9.8
Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacking extension diversity, allowing Deep Packet Inspection (DPI) systems to trivially identify and block proxy traffic, undermining censorship circumvention. (CWE-327)
- Product
- Rakuten Viber Cloak - Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk-client on CVE-2026-30798 · Other software · rustdesk-client · reported by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfeHigh 8.2
Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop, strategy processing modules) allows Protocol Manipulation. This vulnerability is associated with program files src/hbbs_http/sync.Rs and program routines stop-service handler in heartbeat loop. This issue affects RustDesk Client: through 1.4.8.
- Product
- RustDesk Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comrustdesk.com
Mar 5, 2026Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, confiCVE-2026-30797 · Other software · rustdesk-client · reported by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfeCritical 9.3
Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, config import modules) allows Application API Message Manipulation via Man-in-the-Middle. This vulnerability is associated with program files flutter/lib/common.Dart and program routines importConfig() via URI handler. This issue affects RustDesk Client: through 1.4.5.
- Product
- RustDesk Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comrustdesk.com
Mar 5, 2026Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on WindowCVE-2026-30796 · Other software · rustdesk-client · reported by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfeMedium 6.9
Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks. The client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbs_http/sync.rs). Over an intact HTTPS session it is not exposed in transit, but it is a reusable shared secret rather than a zero-knowledge proof, so it is recovered by any party that becomes the API endpoint - under the re-homed/rogue API server (CVE-2026-30797) - and the leaked credential then authorizes the server-side address book. This vulnerability is associated with program files src/hbbs_http/sync.rs and program routines heartbeat sync body builder (emits preset-address-book-password). This issue affects RustDesk Client: through 1.4.8.
- Product
- RustDesk Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comrustdesk.com
Mar 5, 2026Cleartext Transmission of Sensitive Information vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (HeartbeCVE-2026-30795 · Other software · rustdesk-client · reported by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfeHigh 8.7
Cleartext Transmission of Sensitive Information vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop modules) allows Sniffing Attacks. This vulnerability is associated with program files src/hbbs_http/sync.Rs and program routines Heartbeat JSON payload construction (preset-address-book-password). This issue affects RustDesk Client: through 1.4.5.
- Product
- RustDesk Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comgithub.com
Mar 5, 2026Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme haCVE-2026-30793 · Other software · rustdesk-client · reported by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfeCritical 9.3
Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, FFI bridge modules) allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart, src/flutter_ffi.Rs and program routines URI handler for rustdesk://password/, bind.MainSetPermanentPassword(). This issue affects RustDesk Client: through 1.4.5.
- Product
- RustDesk Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comgithub.com
Mar 5, 2026A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Strategy sync, HTTP API client, config optCVE-2026-30792 · Other software · rustdesk-client · reported by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfeHigh 8.3
A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Strategy sync, HTTP API client, config options engine modules) allows Application API Message Manipulation via Man-in-the-Middle. This vulnerability is associated with program files src/hbbs_http/sync.Rs, hbb_common/src/config.Rs and program routines Strategy merge loop in sync.Rs, Config::set_options(). This issue affects RustDesk Client: through 1.4.8.
- Product
- RustDesk Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comrustdesk.com
Mar 5, 2026Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication Attempts vulnerability in rustdesk-client RustDeskCVE-2026-30789 · Other software · rustdesk-client · reported by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfeMedium 5.7
Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication Attempts vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Client login, peer authentication modules) allows Password Brute Forcing. The authentication proof is SHA256(SHA256(password + salt) + challenge), where both the salt and the challenge are generated entirely by the server with no client-side nonce, and the hash uses no slow key-derivation function. A rogue or on-path API/relay server (see CVE-2026-30794 / CVE-2026-30797) can issue a chosen salt and challenge, capture the resulting proof, and recover the password offline. The capture-replay claim (CWE-294) is withdrawn: the challenge is regenerated per connection (challenge = Config::get_auto_password(6)), so a captured proof is not replayable against the legitimate server. The 1.4.7 OTP brute-force limiter and the existing LOGIN_FAILURES counter constrain only ONLINE attempts and do not address offline recovery. This vulnerability is associated with program files src/client.rs and program routines handle_hash(), handle_login_from_ui() (login proof construction
- Product
- RustDesk Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comrustdesk.com
Mar 5, 2026Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerabiCVE-2026-30785 · Other software · rustdesk-client · reported by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfeHigh 8.2
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk, hbb_common on Windows, MacOS, Linux (Password security module, config encryption, machine UID modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program files hbb_common/src/password_security.Rs, hbb_common/src/config.Rs, hbb_common/src/lib.Rs (get_uuid), machine-uid/src/lib.Rs and program routines symmetric_crypt(), encrypt_str_or_original(), decrypt_str_or_original(), get_uuid(), get_machine_id(). This issue affects RustDesk Client: through 1.4.5.
- Product
- RustDesk Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comgithub.com
Mar 5, 2026A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config maCVE-2026-30783 · Other software · rustdesk-client · reported by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfeMedium 4.8
A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config management modules) allows Privilege Abuse. This vulnerability is associated with program files src/rendezvous_mediator.Rs, src/hbbs_http/sync.Rs and program routines API sync loop, api-server config handling. This issue affects RustDesk Client: through 1.4.8.
- Product
- RustDesk Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comrustdesk.com
Mar 5, 2026Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebCliCVE-2026-30791 · Other software · rustdesk-client · reported by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfeHigh 8.7
Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Config import, URI scheme handler, CLI --config modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program files flutter/lib/common.Dart, hbb_common/src/config.Rs and program routines parseRustdeskUri(), importConfig(). This issue affects RustDesk Client: through 1.4.5.
- Product
- RustDesk Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comrustdesk.com
Mar 4, 2026Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator.CVE-2024-57854 · Other software · DOUGDUDE · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors. Data::Rand::Obscure uses Perl's built-in rand() function, which is not suitable for cryptographic functions.
- Product
- Net::NSCA::Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgpatch-diff.githubusercontent.com
Mar 4, 2026A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveragiCVE-2026-23812 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.3
A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique. Successful exploitation enables the redirection of data streams, allowing for the interception or modification of traffic intended for the legitimate network gateway via a Machine-in-the-Middle (MitM) position.
- Product
- HPE Aruba Networking Wireless Operating Systems (AOS-8 & AOS-10)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026A vulnerability in the client isolation mechanism may allow an attacker to bypass Layer 2 (L2) communication restrictions between clients and redirect traffic aCVE-2026-23811 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.3
A vulnerability in the client isolation mechanism may allow an attacker to bypass Layer 2 (L2) communication restrictions between clients and redirect traffic at Layer 3 (L3). In addition to bypassing policy enforcement, successful exploitation - when combined with a port-stealing attack - may enable a bi-directional Machine-in-the-Middle (MitM) attack.
- Product
- HPE Aruba Networking Wireless Operating Systems (AOS-8 & AOS-10)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigCVE-2025-12801 · Other software · Red Hat · reported by Red HatMedium 6.5
A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Mar 3, 2026Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0.CVE-2025-59060 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue.
- Product
- Apache Ranger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Mar 2, 2026Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in OCVE-2025-47147 · Other software · Gallagher · reported by disclosures@gallagher.comMedium 5.7
Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in Operator's mobile device to extract the session token and exploit access for a limited duration. This issue affects Command Centre Mobile Client versions prior to 9.40.123.
- Product
- Command Centre Mobile Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.com
Mar 2, 2026The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe CVE-2025-58406 · Other software · CGM · reported by cvd@cert.plMedium 5.3
The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certifiCVE-2025-30042 · Other software · CGM · reported by cvd@cert.plCritical 9
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/auCVE-2026-3277 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/authentication.ps1 script, which allows an attacker with read access to that file to obtain the OIDC client credentials
- Product
- PowerShell Universal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote atCVE-2026-1698 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Medium 5.3
A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior. This vulnerability only affects the endpoints /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout of the WebClient and WebScheduler web apps.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included.CVE-2026-1697 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Medium 5.3
The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Some HTTP security headers are not properly set by the web server when sending responses to the client application.CVE-2026-1696 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Low 2.3
Some HTTP security headers are not properly set by the web server when sending responses to the client application.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026The installer of FinalCode Client provided by Digital Arts Inc.CVE-2026-25191 · Other software · Digital Arts Inc. · reported by vultures@jpcert.or.jpHigh 8.4
The installer of FinalCode Client provided by Digital Arts Inc. contains an issue with the DLL search path. If a user is directed to place a malicious DLL file and the installer to the same directory and execute the installer, arbitrary code may be executed with the installer's execution privilege.
- Product
- FinalCode Ver.5 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026The installer of FinalCode Client provided by Digital Arts Inc.CVE-2026-23703 · Other software · Digital Arts Inc. · reported by vultures@jpcert.or.jpHigh 8.5
The installer of FinalCode Client provided by Digital Arts Inc. contains an incorrect default permissions vulnerability. A non-administrative user may execute arbitrary code with SYSTEM privilege.
- Product
- FinalCode Ver.5 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026LiveCode is an open-source, client-side code playground.CVE-2026-27701 · Other software · live-codes · reported by GitHubHigh 8.8
LiveCode is an open-source, client-side code playground. Prior to commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11, LiveCode's `i18n-update-pull` GitHub Actions workflow is vulnerable to JavaScript injection. The title of the Pull Request associated with the triggering issue comment is interpolated directly into a `actions/github-script` JavaScript block using a GitHub Actions template expression. An attacker who opens a PR with a crafted title can inject arbitrary JavaScript that executes with the privileges of the CI bot token (`CI_APP_ID` / `CI_APP_PRIVATE_KEY`), enabling exfiltration of repository secrets and unauthorized GitHub API operations. Commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11 fixes the issue.
- Product
- livecodes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method.CVE-2026-27699 · Other software · patrickjuchli · reported by GitHubCritical 9.1
The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.
- Product
- basic-ftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of Server-Side Security vulnerability.CVE-2026-23859 · Other software · Dell · reported by security_alert@emc.comLow 2.7
Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of Server-Side Security vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability to Protection mechanism bypass.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 store a user password in a client-side cookie as a Base64-encoded value accessibCVE-2026-27520 · Other software · Binardat Ltd. · reported by VulnCheckHigh 8.7
Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 store a user password in a client-side cookie as a Base64-encoded value accessible via the web interface. Because Base64 is reversible and provides no confidentiality, an attacker who can access the cookie value can recover the plaintext password.
- Product
- 10G08-0800GSM Network Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbinardat.comvulncheck.com
Feb 24, 2026Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded in client-side JavaScript.CVE-2026-27519 · Other software · Binardat Ltd. · reported by VulnCheckHigh 8.7
Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded in client-side JavaScript. Because the key is static and exposed, an attacker can decrypt protected values and defeat confidentiality protections.
- Product
- 10G08-0800GSM Network Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbinardat.comvulncheck.com
Feb 23, 2026An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary files and conduct deCVE-2026-3091 · Network & remote access · Synology · reported by security@synology.comMedium 6.7
An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary files and conduct denial-of-service during installation by placing a malicious DLL in advance in the same directory as the installer.
- Product
- Synology Presto Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026Tenda FH1203 V2.0.1.6 contains a stack-based buffer overflow vulnerability in the modify_add_client_prio function, which is reachable via the formSetClientPrio CVE-2025-69700 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda FH1203 V2.0.1.6 contains a stack-based buffer overflow vulnerability in the modify_add_client_prio function, which is reachable via the formSetClientPrio CGI handler.
- Product
- Fh1203 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability.CVE-2026-2490 · Other software · RustDesk · reported by zdi-disclosures@trendmicro.comMedium 5.5
RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of RustDesk Client for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Transfer File feature. By uploading a symbolic link, an attacker can abuse the service to read arbitrary files. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-27909.
- Product
- Client for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Feb 19, 2026uTLS is a fork of crypto/tls, created to customize ClientHello for fingerprinting resistance while still using it for the handshake.CVE-2026-27017 · Other software · refraction-networking · reported by GitHubLow 2.3
uTLS is a fork of crypto/tls, created to customize ClientHello for fingerprinting resistance while still using it for the handshake. Versions 1.6.0 through 1.8.0 contain a fingerprint mismatch with Chrome when using GREASE ECH, related to cipher suite selection. When Chrome selects the preferred cipher suite in the outer ClientHello and for ECH, it does so consistently based on hardware support—for example, if it prefers AES for the outer cipher suite, it also uses AES for ECH. However, the Chrome parrot in uTLS hardcodes AES preference for outer cipher suites but selects the ECH cipher suite randomly between AES and ChaCha20. This creates a 50% chance of selecting ChaCha20 for ECH while using AES for the outer cipher suite, a combination impossible in Chrome. This issue only affects GREASE ECH; in real ECH, Chrome selects the first valid cipher suite when AES is preferred, which uTLS handles correctly. This issue has been fixed in version 1.8.1.
- Product
- utls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026uTLS is a fork of crypto/tls, created to customize ClientHello for fingerprinting resistance while still using it for the handshake.CVE-2026-26994 · Other software · refraction-networking · reported by GitHubMedium 6.5
uTLS is a fork of crypto/tls, created to customize ClientHello for fingerprinting resistance while still using it for the handshake. In versions 1.6.7 and below, uTLS did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4.1.3 when using a uTLS ClientHello spec. This allowed an active network adversary to downgrade TLS 1.3 connections initiated by a uTLS client to a lower TLS version (e.g., TLS 1.2) by modifying the ClientHello message to exclude the SupportedVersions extension, causing the server to respond with a TLS 1.2 ServerHello (along with a downgrade canary in the ServerHello random field). Because uTLS did not check the downgrade canary in the ServerHello random field, clients would accept the downgraded connection without detecting the attack. This attack could also be used by an active network attacker to fingerprint uTLS connections. This issue has been fixed in version 1.7.0.
- Product
- utls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension.CVE-2026-2408 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.7
Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension.
- Product
- Cloud Workloads
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Client Testimonial Slider: Stored Cross-Site ScriptingCVE-2026-2716 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Client Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Testimonial Heading' setting in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Client Testimonial Slider
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Client Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2026-25364 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.8.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.8
- What to do
- Affects up to 20.8.8. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Client Portal: Missing AuthorizationCVE-2026-25003 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in madalin.ungureanu Client Portal client-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Portal: from n/a through <= 1.2.1.
- Product
- Client Portal
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Client Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been admiCVE-2026-2733 · Other software · Red Hat · reported by Red HatLow 3.8
A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously valid credentials can still be used to obtain authentication tokens. This weakens administrative controls and could allow unintended access to container registry resources.
- Product
- Red Hat build of Keycloak 26.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-26281 · Other software · InvoicePlane · reported by GitHubMedium 4.4
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Sumex invoice view allows an authenticated user with client and invoice management privileges to execute arbitrary JavaScript in the browser of any user viewing the invoice. This can lead to session hijacking, data theft, or other malicious actions on behalf of the victim user. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-26270 · Other software · InvoicePlane · reported by GitHubMedium 5.4
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane (latest version) that allows an authenticated user with permissions to manage Invoice Groups to inject malicious JavaScript into the "Identifier Format" field. This script executes when any user views the invoice list or the main dashboard. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.