Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,731 results · page 4 of 155
Oct 14, 2026Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCVE-2026-76519 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
- Product
- Secure Email Gateway
- On CISA’s list since
- Oct 14, 2026 (federal fix deadline Oct 17, 2026)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsec.cloudapps.cisco.comcisa.gov
Oct 14, 2026BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail meCVE-2026-110593 · Other software · MicroPyramid · reported by VulnCheckMedium 5.3
BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated organization members can submit template tags through POST /api/accounts/<id>/create_mail/ to disclose the rendering context and loaded Python modules, or block the shared Celery worker with nested loops.
- Product
- BottleCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTECVE-2026-110260 · Other software · OW2 · reported by VulnCheckMedium 6.8
OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge allocations and an OutOfMemoryError that crashes the JVM.
- Product
- ASM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordasm.ow2.iogitlab.ow2.org
Oct 14, 2026In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ksmbd_session_register() destroys valid seCVE-2026-98420 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ksmbd_session_register() destroys valid sessions after ten seconds of inactivity whenever a client starts another SessionSetup exchange. This confuses Session.IdleTime with Session.ExpirationTime. Windows can create additional authenticated sessions on an existing connection, so deleting the older session invalidates its tree connects and makes mapped drives fail with STATUS_NETWORK_NAME_DELETED. The session expiration rules require the server to change a valid session to expired only after its credential expiration time passes. A valid or expired session otherwise keeps its connection from being scavenged. Connections that have not negotiated a dialect, have no sessions, or have only InProgress sessions are disconnected after an implementation-specific timeout. Use the Windows-compatible 45 second value and run the expiration check periodically for both TCP and SMB Direct. Keep zero as an infinite credential expiration time, and count each Valid-to-Expired transition. Set expired sessions to InProgress when they reauthenticate. If authentication fails, remove the
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 14, 2026Responsive Blocks: Does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site ownerCVE-2026-97315 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that email.
- Product
- Responsive Blocks
- Fixed in
- 2.3.0
- What to do
- Update Responsive Blocks to 2.3.0 or newer.
Oct 14, 2026Email Template Customizer for WooCommerce: Improper Control of Generation of Code ('Code Injection')CVE-2026-103358 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.
- Product
- Email Template Customizer for WooCommerce
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Email Template Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026ShopMagic – email automation for: Local File InclusionCVE-2026-103367 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires a published recipe that processes the {{ customer.first_name }} placeholder — the plugin's built-in "New Order email with social media profile links" recipe satisfies this requirement out of the box, making the default configuration exploitable with no account, cookie, or nonce by simply submitting a guest checkout with the payload as the billing first name.
- Product
- ShopMagic – email automation for
- Affected
- up to 4.9.0
- What to do
- Affects up to 4.9.0. Update ShopMagic – email automation for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026Cart Abandonment Recovery for WooCommerce: Does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting itCVE-2026-96900 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that customer's stored abandoned-cart data.
- Product
- Cart Abandonment Recovery for WooCommerce
- Fixed in
- 2.1.4
- What to do
- Update Cart Abandonment Recovery for WooCommerce to 2.1.4 or newer.
Oct 13, 2026Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation: Privilege EscalationCVE-2026-104749 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because `IntegrationHandler::executeWithCapture()` stores raw, attacker-controlled field values — including `user_pass` and `user_email` — verbatim into `wp_btcbi_log.field_data` on anonymous front-end requests with no capability check, and `LogHandler::reexecute()` feeds that stored payload back through `Flow::execute()` inside the replaying administrator's session without validating the identity that originally produced the data, causing `RegistrationController::updateUser()` to resolve the target user ID to the administrator and write the attacker-supplied password via `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the `user_pass` parameter of the WP User Registration "Update User" action, and that the administrator subsequent
- Product
- Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
- Affected
- up to 2.10.6
- What to do
- Affects up to 2.10.6. Update Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 13, 2026Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-106625 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe FrameMaker 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-104344 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe FrameMaker 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Framemaker is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service.CVE-2026-104343 · Other software · Adobe · reported by AdobeMedium 5.5
Adobe Framemaker is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe FrameMaker 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-104342 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe FrameMaker 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-104341 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe FrameMaker 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-104340 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe FrameMaker 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-103967 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe FrameMaker 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-103966 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe FrameMaker 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2026-103857 · Other software · Adobe · reported by AdobeMedium 5.5
Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe FrameMaker 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2026-103856 · Other software · Adobe · reported by AdobeMedium 5.5
Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe FrameMaker 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108385 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108384 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type's aliases value directly into a generated types.confixed annotation. A list is represented with quoted entries, but a bare string is emitted as an unquoted Python expression and evaluated when the generated module is imported, allowing arbitrary code execution from a crafted schema. Version 0.70.6 fixes the vulnerability by rejecting aliases values that are not lists.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108383 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member reference after applying case conversion but without validating it as an identifier. Newlines, operators, and punctuation can escape the intended reference and inject constrained statements into the generated module, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating enum defaults as names.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108382 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates each schema-controlled enum symbol between double quotes in a generated enum assignment. When generator classes are used directly, a quote can terminate the string literal and inject arbitrary Python code into the enum class body, which executes when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping enum symbol values before rendering them.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108381 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108380 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108379 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's namespace value between quotes inside a generated types.confixed annotation without escaping or validating it. A crafted quote can terminate the namespace string and alter the surrounding annotation expression, which Python evaluates when the generated class is defined, allowing arbitrary code execution. Version 0.70.6 fixes the vulnerability by requiring the namespace to be a dot-separated sequence of valid Avro names.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108378 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a schema record's doc value into a generated triple-double-quoted class docstring without escaping quotes or backslashes. A crafted triple-quote sequence can close the docstring and inject statements into the generated class body, while a trailing backslash can escape the generated closing delimiter, allowing Python code execution during module import. Version 0.70.6 fixes the vulnerability by escaping quotes, backslashes, and unsafe control characters before rendering docstrings.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108377 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro record name into the quoted Meta.schema_name field of generated Python source without escaping it. A crafted name can terminate the string literal and inject statements into the generated class body, which execute when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108376 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled referenced record name into the callable position of a generated default_factory lambda without validating it as an Avro name. A crafted record name can become an arbitrary Python expression that executes when an instance of the generated model consumes the field default. Version 0.70.6 fixes the vulnerability by rejecting record names that do not match the Avro name grammar.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.CVE-2026-108375 · Other software · marcosschroh · reported by GitHubHigh 8.8
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module, which execute when the module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.
- Product
- dataclasses-avroschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticateCVE-2026-110116 · Other software · risesoft-y9 · reported by VulnCheckHigh 8.8
Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and fileName parameters to POST /rest/storeFile to create or overwrite service-writable files, potentially achieving code execution.
- Product
- Digital-Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler thatCVE-2026-110115 · Other software · risesoft-y9 · reported by VulnCheckHigh 8.7
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials.
- Product
- Digital-Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine.CVE-2026-54700 · Other software · connectbot · reported by GitHubMedium 6.9
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1.
- Product
- cbssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine.CVE-2026-54697 · Other software · connectbot · reported by GitHubMedium 6.7
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining input. An application or user that loads an attacker-provided private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive allocation, or an uncaught OutOfMemoryError. SSH server host keys and agent-forwarding messages do not use this application-supplied private-key input path. No usable weakened key and no confidentiality or integrity impact have been demonstrated. This issue is fixed in version 0.3.1.
- Product
- cbssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer aritCVE-2026-109964 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetCVE-2026-109963 · Other software · froxlor · reported by VulnCheckMedium 5.3
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign mailbodyid values in edit requests to read other admins' email templates, including the full administrator's.
- Product
- froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the addCVE-2026-109958 · Other software · espocrm · reported by VulnCheckMedium 5.3
EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the emailAddress field.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation: Stored Cross-Site ScriptingCVE-2026-102007 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow that binds the public Bit Assist webhook to a BuddyBoss "Send Notification" action with a form field mapped to notification_content, and the attacker to know the flow's UUID callback URL.
- Product
- Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
- Affected
- up to 2.10.6
- What to do
- Affects up to 2.10.6. Update Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 12, 2026Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the CVE-2026-109629 · Other software · frappe · reported by VulnCheckMedium 5.3
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient lists and message content to send attacker-controlled messages carrying the organisation's sending identity.
- Product
- erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML.CVE-2026-109601 · Other software · frappe · reported by VulnCheckHigh 7.1
Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications.CVE-2026-109600 · Other software · frappe · reported by VulnCheckMedium 6.9
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-CVE-2023-54412 · Other software · frappe · reported by VulnCheckHigh 7.1
Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom ResourCVE-2026-18513 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
- Product
- Maximo Application Suite - Location Service for Esri Component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input.CVE-2020-37280 · Other software · PelionIoT · reported by VulnCheckHigh 8.7
cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.
- Product
- cbor-sync
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a poiCVE-2026-109282 · Other software · ImageMagick · reported by VulnCheckLow 2
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a SIGABRT or SIGSEGV, crashing the process and causing denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds oCVE-2026-109281 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression processed can read out-of-bounds heap memory, potentially disclosing limited memory contents.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operCVE-2026-109280 · Other software · ImageMagick · reported by VulnCheckLow 2
ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure can trigger freed memory access, causing crashes or memory corruption.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the CVE-2026-109279 · Other software · ImageMagick · reported by VulnCheckLow 2
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the policy by multiple threads trigger a race condition that causes a heap buffer over-write. An attacker able to induce concurrent security policy access can crash the application, causing a denial of service.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a reqCVE-2026-109278 · Other software · ImageMagick · reported by VulnCheckMedium 6.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling.CVE-2026-109277 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use the -script operation to close file descriptors not opened by the current operation, circumventing configured security policies.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.