Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,900 results · page 4 of 138
Oct 12, 2026Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface.CVE-2026-103524 · Other software · Thelia · reported by cret@cert.orgMedium 4.8
Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of InformatiCVE-2026-18390 · Other software · Ministry of Justice General Directorate of Information Technology · reported by iletisim@usom.gov.trHigh 7.8
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on iOS allows OS Command Injection. This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.
- Product
- UYAP Document Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux aCVE-2026-12613 · Other software · Ministry of Justice General Directorate of Information Technology · reported by iletisim@usom.gov.trHigh 8.8
Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection. This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.
- Product
- UYAP Document Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disCVE-2026-109177 · Other software · moxi624 · reported by VulnCheckMedium 5.3
MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which update rows without admin_uid checks, relocating or renaming other users' files and folders.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files vCVE-2026-109176 · Other software · moxi624 · reported by VulnCheckMedium 5.3
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-dCVE-2026-109175 · Other software · moxi624 · reported by VulnCheckMedium 5.3
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and never by admin_uid, to obtain other administrators' file names and download URLs.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user.CVE-2026-78358 · Other software · OTRS GmbH (former OTRS AG) · reported by security@otrs.comMedium 4.3
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can therefore cause the browser of an authenticated administrator to execute the cleanup action by embedding a crafted request in a malicious web page. Successful exploitation can delete existing DBUpdate log entries. This may reduce the availability of diagnostic and historical information used for troubleshooting and auditing. The impact is limited to DBUpdate log entries that exist at the time the forged request is processed. Additional administrative endpoints were identified that do not validate a ChallengeToken. Some of these endpoints can trigger administrative actions such as deploying or synchronizing already existing configuration. They do not allow an attacker to introduce arbitrary new configuration through the CSRF request itself. Export and read-only endpoints were also identified without ChallengeToken validation. While these endpoints may be triggered through a forged cross-site
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended diCVE-2026-78355 · Other software · OTRS GmbH (former OTRS AG) · reported by security@otrs.comHigh 8.7
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating system file permissions. On OTRS versions prior to OTRS 7, the effective permissions of the web server process are relevant. Starting with OTRS 7, access is limited by the permissions of the dedicated OTRS user. Files with overly permissive ownership or file system permissions may therefore also be affected. The affected functionality may additionally attempt to include controlled files in a support bundle. However, support bundles are sent to a predefined OTRS support address, and direct disclosure of arbitrary files to the attacker has not been demonstrated. An attacker therefore requires valid administrative access to exploit the vulnerable functionality. The primary demonstrated impact is the deletion of files outside the intended directory within the effective permissions of the OTRS application process. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in thCVE-2026-48212 · Other software · OTRS GmbH (former OTRS AG) · reported by security@otrs.comMedium 4.8
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack.CVE-2026-48211 · Other software · OTRS GmbH (former OTRS AG) · reported by security@otrs.comMedium 5.4
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Hotel Booking: Does not implement CSRF protection on its administrative booking order managementCVE-2026-84166 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.
- Product
- Hotel Booking
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web interface.CVE-2026-108925 · Other software · Cohesity · reported by cna@cyber.gov.ilMedium 6.1
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web interface. This issue affects NetBackup Administration Console web interface: versions before 11.2. https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0002.md
- Product
- NetBackup Administration Console web interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed'CVE-2026-108735 · Other software · miniflux · reported by VulnCheckMedium 5.3
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks to probe internal ports and send proxy-style requests to internal services.
- Product
- miniflux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Web Vitals Tracking: Does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative pageCVE-2026-87760 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators.
- Product
- Web Vitals Tracking
- Affected
- up to 5.4.2
- What to do
- Affects up to 5.4.2. Update Web Vitals Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmploCVE-2026-108708 · Other software · WuKongOpenSource · reported by VulnCheckHigh 8.7
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.
- Product
- Wukong_HRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.CVE-2026-45440 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.
- Affected
- up to 9.2
- What to do
- Affects up to 9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.CVE-2026-42722 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.
- Affected
- up to 3.29.13
- What to do
- Affects up to 3.29.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Administrator SQL Injection in Leyka <= 3.32.3 versions.CVE-2026-42717 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Leyka <= 3.32.3 versions.
- Affected
- up to 3.32.3
- What to do
- Affects up to 3.32.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commandCVE-2026-108592 · Other software · SWE-agent · reported by VulnCheckMedium 6
mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network.
- Product
- mini-swe-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusCVE-2026-108591 · Other software · innocommerce · reported by VulnCheckMedium 5.9
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials.
- Product
- InnoShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026miniorange otp verification: Incorrect Privilege AssignmentCVE-2026-106610 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.
- Product
- miniorange otp verification
- Affected
- up to 5.5.7
- What to do
- Affects up to 5.5.7. Update miniorange otp verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026LTL Freight Quotes: Does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative pageCVE-2026-87780 · WordPress plugins & themes · reported by WPScanHigh 8.8
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.
- Product
- LTL Freight Quotes
- Fixed in
- 4.2.19
- What to do
- Update LTL Freight Quotes to 4.2.19 or newer.
Oct 10, 2026Rank Math SEO: Does not escape a stored redirection source value before outputting it in an administrative list viewCVE-2026-104754 · WordPress plugins & themes · reported by WPScanLow 3.5
The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite.
- Product
- Rank Math SEO
- Fixed in
- 1.0.280
- What to do
- Update Rank Math SEO to 1.0.280 or newer.
Oct 9, 2026Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves.CVE-2026-108265 · Other software · Privasys · reported by GitHubCritical 9.1
Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in wasm-v0.40.0.
- Product
- enclave-os-mini
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware oCVE-2026-33367 · Other software · Red Lion Controls · reported by ics-cert@hq.dhs.govCritical 9.3
SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.
- Product
- 700 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentialsCVE-2026-33272 · Other software · Red Lion Controls · reported by ics-cert@hq.dhs.govMedium 6.8
A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally.
- Product
- 700 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.CVE-2026-32645 · Other software · Red Lion Controls · reported by ics-cert@hq.dhs.govCritical 9.2
Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.
- Product
- 700 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use.CVE-2026-105278 · Other software · Grid Protection Alliance · reported by ics-cert@hq.dhs.govCritical 9.3
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.
- Product
- openPDC (Docker image)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenticated administrators to inject SQL via tCVE-2025-71428 · Other software · banq · reported by VulnCheckMedium 6.9
Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents, including other accounts' password hashes.
- Product
- jivejdon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an attacker with administrative privileges and aCVE-2026-12109 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an attacker with administrative privileges and access to the local management interface to execute arbitrary code due to an unbounded write to a fixed-size stack buffer.
- Product
- Security Verify Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum.CVE-2026-106437 · Other software · MongoDB · reported by cna@mongodb.comMedium 5.9
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.
- Product
- C Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.CVE-2026-107578 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comMedium 6.7
Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows, operations run with administrator rights by the installer, DBSetup, the Control Panel or an administrator wrote log entries and crash records into the log folder, created, deleted and changed the permissions of the self-signed certificate and private key in the data folder, and rewrote message files in the data folder, all by path in folders the service account (NT SERVICE\hMailServer, the default for new installations since 6.3.4) can modify, following junctions and mount points; and the store-maintenance operations reached files by names taken from the database, which the service account can write, including names outside the data folder. On Linux, the store-maintenance and object-storage operations run as root followed symbolic links the service account (the packaged hmailserver user, which owns the data folder) planted in it, so a root-run operation read, wrote or removed the link's target as
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6CVE-2026-104659 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 7.5
Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding. The listener, which is off by default and bound to the loopback when enabled, answered requests whatever their Host header named, and a failed sign-in with the administrator's password from the loopback was neither auto-banned nor delayed. A web page whose host name the attacker rebinds to 127.0.0.1, opened in a browser on the server, can therefore send authenticated requests to the listener, read the answers and try administrator passwords at full speed until one is accepted, giving the attacker full administrative control of the mail server.
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administraCVE-2026-71895 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.1
An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the Kubernetes API outside DolphinScheduler. The impact depends on the permissions granted to the disclosed credentials. If the kubeconfig provides cluster-admin or broadly privileged service-account access, an attacker may read Kubernetes Secrets, create pods, and establish persistent access to the cluster. This issue affects Apache DolphinScheduler: from 3.2.0 before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.
- Product
- Apache DolphinScheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 8, 2026An authentication flaw exists in the Brocade ASCG administrative management service component.CVE-2026-85489 · Other software · Brocade · reported by sirt@brocade.comHigh 8.7
An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026SMS Alert: Does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbersCVE-2026-94258 · WordPress plugins & themes · reported by WPScanLow 2.7
The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the SMS Alert WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site.
- Product
- SMS Alert
- Fixed in
- 4.0.1
- What to do
- Update SMS Alert to 4.0.1 or newer.
Oct 8, 2026A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OSCVE-2026-94587 · Other software · Brocade · reported by sirt@brocade.comMedium 6.9
A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can overflow stack buffers causing a crash of the weblinker daemon.
- Product
- Fabric OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric CVE-2026-94586 · Other software · Brocade · reported by sirt@brocade.comHigh 8.5
A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges
- Product
- Fabric OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API.CVE-2026-87688 · Other software · Brocade · reported by sirt@brocade.comHigh 8.5
An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution in external system routines. An authenticated attacker with privileges to perform certificate deletion requests can leverage this flaw to execute arbitrary system commands with the privileges of the underlying management daemon. This vulnerability affects Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1.
- Product
- Fabric OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could CVE-2026-76501 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM and SRv6 features are enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.
- Product
- Cisco NX-OS Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 7, 2026A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, rCVE-2026-76486 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.
- Product
- Cisco NX-OS Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 7, 2026A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, rCVE-2026-76485 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.
- Product
- Cisco NX-OS Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 7, 2026A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco NexuCVE-2026-76465 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validation when an affected device is processing an MPLS echo-request packet. An attacker could exploit this vulnerability by sending a crafted MPLS echo-request to an IP address on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a device reload and a DoS condition.
- Product
- Cisco NX-OS Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 7, 2026A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration fieldCVE-2026-107202 · Other software · jonssonyan · reported by cret@cert.orgCritical 9.1
A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or format validation, arbitrary OS commands can be injected and executed with root privileges.
- Product
- h-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers toCVE-2026-107159 · Other software · miniupnp project · reported by VulnCheckHigh 7.1
MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and denying UPnP IGD service.
- Product
- miniupnpd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administCVE-2025-64391 · Other software · Veeam · reported by support@hackerone.comMedium 4.1
This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it.
- Product
- Agent for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026WP Coder: Does not restrict access to its PHP code-execution feature to administratorsCVE-2026-104677 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromise the site.
- Product
- WP Coder
- Fixed in
- 4.5.2
- What to do
- Update WP Coder to 4.5.2 or newer.
Oct 6, 2026A SQL injection vulnerability in the API of ClearPass Policy Manager could allow a remote authenticated attacker with administrative privileges to conduct SQL iCVE-2026-79811 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
A SQL injection vulnerability in the API of ClearPass Policy Manager could allow a remote authenticated attacker with administrative privileges to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to execute arbitrary database commands.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced dCVE-2026-103007 · Other software · Elastic · reported by security@elastic.coHigh 7.2
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that should remain restricted, including internal security data. This can enable further escalation up to full administrative control of the cluster.
- Product
- Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration.CVE-2026-101156 · Other software · Arista Networks · reported by psirt@arista.comMedium 6.2
A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful exploitation may allow the attacker to act through the victim's authenticated browser session to access sensitive data, modify configurations, or disrupt managed wireless services.
- Product
- CloudVision CUE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.