Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9,266 results · page 4 of 186
Oct 16, 2026Salon Booking System – Appointment Booking for Salons, Barbershops & Spas: Stored Cross-Site ScriptingCVE-2026-109232 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.
- Product
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
- Affected
- up to 10.31.9
- What to do
- Affects up to 10.31.9. Update Salon Booking System – Appointment Booking for Salons, Barbershops & Spas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Debloat – Remove Unused CSS, Optimize JS: Directory TraversalCVE-2026-104769 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (with the default Inline Google Fonts option active), but once that condition is met the attack is trivially triggered by an unauthenticated visitor with a single crafted GET request to the public search URL.
- Product
- Debloat – Remove Unused CSS, Optimize JS
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Debloat – Remove Unused CSS, Optimize JS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access oCVE-2026-111348 · Other software · likeshop · reported by VulnCheckMedium 5.3
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.
- Product
- likeshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 inCVE-2026-111330 · Other software · juggleim · reported by VulnCheckHigh 8.2
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.
- Product
- JuggleIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code overCVE-2026-108452 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the datCVE-2026-111170 · Other software · kedro-org · reported by VulnCheckHigh 7.1
kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.
- Product
- kedro-datasets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the medCVE-2026-78851 · Other software · reported by MITREMedium 6.5
Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary filesCVE-2026-111093 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer (peach.pas, grid_obj_open) in PeaZip 10.5.0 CVE-2026-104024 · Other software · PeaZip · reported by 4daa8cea-433a-44bd-9456-53b127fc289aMedium 4.6
Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer (peach.pas, grid_obj_open) in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitrary command, with no confirmation dialog. The prompt (Do you want to run this file?) is gated by SECEXTCONST, a hard-coded list of seven extensions (exe cmd msi bat ps1 vbs reg); the check is an exact string comparison of the entry extension against that list, so it answers only whether the extension is one of the seven and never whether the shell will execute the file. Shell-executable and scripting-host types that Windows runs through ShellExecuteW are absent from the list, among them .url and .lnk. An archived Windows Internet Shortcut (.url) whose URL line is attacker-controlled is launched with no prompt, while the byte-identical content in an entry named .bat does raise the warning in the same session. A .lnk entry raises the ceiling from launching a program to running a command line, because a Windows shortcut carries arguments: a proof-of-concept shortcut targeting cmd.exe with a
- Product
- PeaZip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convCVE-2026-104025 · Other software · PeaZip · reported by 4daa8cea-433a-44bd-9456-53b127fc289aHigh 8.4
Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable insi
- Product
- PeaZip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices: Limited Privilege EscalationCVE-2026-8145 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'process_registration' due to missing validation on the 'wholesalex_registration_role' parameter. This makes it possible for unauthenticated attackers to register as any existing WholesaleX role. The vulnerability was partially patched in version 2.3.8.
- Product
- WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a ..CVE-2026-79824 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8
A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive.
- Product
- HPE NonStop Python 3.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Qsirch.CVE-2026-50619 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.3
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later
- Product
- Qsirch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A relative path traversal vulnerability has been reported to affect QuMagie.CVE-2026-41545 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.6
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later
- Product
- QuMagie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Video Station.CVE-2026-34015 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.7
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Qsync Central.CVE-2026-26243 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.2
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.6 and later Qsync Central 5.1.0.2 and later Qsync Central 5.2.0.4 and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) beCVE-2026-58099 · Other software · FreeBSD · reported by secteam@freebsd.orgHigh 7
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges.
- Product
- FreeBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect QcalAgent.CVE-2026-41544 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.7
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and later
- Product
- QcalAgent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A relative path traversal vulnerability has been reported to affect Download Station.CVE-2026-39993 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.7
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Download Station 5.10.2.313 and later Download Station 5.11.3.322 and later
- Product
- Download Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Qsync Central.CVE-2026-24718 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Video Station.CVE-2025-66275 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.7
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Video Station.CVE-2025-66272 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.7
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the CVE-2026-0312 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 4.3
Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.
- Product
- Checkov by Prisma Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Oct 14, 2026Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded travCVE-2026-110766 · Other software · colanode · reported by VulnCheckMedium 5.3
Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.
- Product
- colanode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Salevo: Improper Control of Generation of Code ('Code Injection')CVE-2026-103081 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0.
- Product
- Salevo
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Salevo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCVE-2026-76519 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
- Product
- Secure Email Gateway
- On CISA’s list since
- Oct 14, 2026 (federal fix deadline Oct 17, 2026)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsec.cloudapps.cisco.comcisa.gov
Oct 14, 2026An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthentCVE-2026-102087 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7.1
An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged. This issue affects: Junos OS: * All versions before 23.2R2-S6; * 23.4 versions before 23.4R2-S7; * 24.2 versions before 24.2R2-S4; * 24.4 versions before 24.4R2-S4; * 25.2 versions before 25.2R1-S2, 25.2R2; Junos OS Evolved: * All versions before 23.2R2-S6-EVO; * 23.4 versions before 23.4R2-S8.11-EVO; * 24.2 versions before 24.2R2-S4-EVO; * 24.4 versions before 24.4R2-S5-EVO; * 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.net
Oct 14, 2026Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outsideCVE-2026-110717 · Other software · meetecho · reported by VulnCheckMedium 6.9
Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordings_path via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending in -audio.mjr, -video.mjr or -data.mjr anywhere the Janus process can write outside protected folders.
- Product
- janus-gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the modCVE-2026-110657 · Other software · Khronos Group · reported by VulnCheckMedium 4.8
Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or absolute paths in labels to create or overwrite '.dat' files when users convert, save, or generate weights.
- Product
- nnef
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated uCVE-2026-110645 · Other software · ArsalanDotMe · reported by VulnCheckCritical 9.3
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.
- Product
- video-stitch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at CVE-2026-110690 · Other software · coderaiser · reported by VulnCheckHigh 8.7
Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.
- Product
- cloudcmd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 14, 2026Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilityCVE-2026-101217 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- Unisphere for PowerMax vApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create oCVE-2026-110458 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Low 3.7
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device.
- Product
- UniFi Protect AI Key
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain iCVE-2026-110457 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Low 3.7
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device.
- Product
- UniFi Protect AI Key
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in an arCVE-2026-103820 · Other software · Adobe · reported by AdobeMedium 5.5
CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended restrictions. Exploitation of this issue requires user interaction in that a victim must extract a maliciously crafted file.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file CVE-2026-90530 · Websites & servers · Adobe · reported by AdobeCritical 9.3
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordguides.adobe.comguides.adobe.com
Oct 13, 2026Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary dirCVE-2026-63162 · Other software · Omnispace · reported by VulnCheckHigh 8.7
Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.
- Product
- Agora Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comagora-project.net
Oct 13, 2026Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbCVE-2026-106634 · Other software · Adobe · reported by AdobeHigh 7.7
Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a netwCVE-2026-102238 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.CVE-2026-96953 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.CVE-2026-96950 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.CVE-2026-96949 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.CVE-2026-96947 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.CVE-2026-96946 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.CVE-2026-96930 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose informatCVE-2026-85932 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.CVE-2026-85927 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.CVE-2026-85918 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.CVE-2026-85909 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.CVE-2026-85825 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.