Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,269 results · page 4 of 26
May 20, 2026A broken access control issue has been identified in the Talend Administration Center, that allows a user with “View” permission to modify the Talend Studio updCVE-2026-9057 · Other software · Talend · reported by 4ac701fe-44e9-4bcd-9585-dd6449257611High 8.2
A broken access control issue has been identified in the Talend Administration Center, that allows a user with “View” permission to modify the Talend Studio update URL. This issue was resolved in a patch, which is already available.
- Product
- Talend Administration Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.CVE-2026-41613 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.CVE-2026-41612 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.
- Product
- Visual Studio Code - Live Preview extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.CVE-2026-41611 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security CVE-2026-41610 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.3
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized atCVE-2026-41109 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A vulnerability was identified in BigSweetPotatoStudio HyperChat up to 2.0.0-alpha.63.CVE-2026-7223 · Other software · BigSweetPotatoStudio · reported by VulDBMedium 5.5
A vulnerability was identified in BigSweetPotatoStudio HyperChat up to 2.0.0-alpha.63. Affected by this issue is the function fetch of the file packages/core/src/http/aiProxyMiddleware.mts of the component AI Proxy Middleware. Such manipulation of the argument baseurl leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- HyperChat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0.CVE-2026-7147 · Other software · JoeCastrom · reported by VulDBMedium 5.5
A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is some unknown functionality of the file server/routes/llm.js of the component LLM Models API. Performing a manipulation of the argument req.query.base_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mcp-chat-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to execute a directory traversal.CVE-2026-30462 · Other software · reported by MITREMedium 4.3
A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to execute a directory traversal.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compentest-tools.com
Apr 26, 2026A vulnerability was detected in ByteDance coze-studio up to 0.5.1.CVE-2026-7023 · Other software · ByteDance · reported by VulDBLow 2.1
A vulnerability was detected in ByteDance coze-studio up to 0.5.1. Affected by this vulnerability is the function ExecuteSQL of the file backend/domain/memory/database/service/database_impl.go of the component databaseTool. Performing a manipulation results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- coze-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Apr 23, 2026elFinder is an open-source file manager for web, written in JavaScript using jQuery UI.CVE-2026-41247 · Other software · Studio-42 · reported by GitHubHigh 8.9
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This vulnerability is fixed in 2.1.67.
- Product
- elFinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user vCVE-2026-30459 · Other software · Thedaylightstudio · reported by MITREHigh 7.1
An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compentest-tools.com
Apr 15, 2026Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the fCVE-2026-30461 · Other software · Thedaylightstudio · reported by MITREHigh 8.3
Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compentest-tools.com
Apr 14, 2026Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.CVE-2026-33116 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.
- Product
- .NET 10.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comaccess.redhat.com
Apr 14, 2026Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.CVE-2026-32203 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
- Product
- .NET 10.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comaccess.redhat.com
Apr 14, 2026Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to diCVE-2026-23653 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.7
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network.
- Product
- Microsoft Visual Studio Code CoPilot Chat Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.CVE-2026-30460 · Other software · Thedaylightstudio · reported by MITREHigh 8.8
Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compentest-tools.com
Apr 7, 2026An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations thatCVE-2026-1078 · Other software · Pegasystems · reported by security@pega.comHigh 7.2
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge. A bad actor could create a website that includes malicious code. The vulnerability could occur if a Robot Runtime user navigates to the malicious website.
- Product
- Pega Robot Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authenticated actoCVE-2026-5709 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 7.7
Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.
- Product
- Research and Engineering Studio (RES)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Apr 6, 2026Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to version 2026.03 could CVE-2026-5708 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.7
Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to version 2026.03 could allow an authenticated remote user to escalate privileges, assume the virtual desktop host instance profile permissions, and interact with AWS resources and services via a crafted API request. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.
- Product
- Research and Engineering Studio (RES)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Apr 6, 2026Unsanitized input in an OS command in the virtual desktop session name handling in AWS Research and Engineering Studio (RES) version 2025.03 through 2025.12.01 CVE-2026-5707 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.7
Unsanitized input in an OS command in the virtual desktop session name handling in AWS Research and Engineering Studio (RES) version 2025.03 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands as root on the virtual desktop host via a crafted session name. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.
- Product
- Research and Engineering Studio (RES)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Apr 6, 2026Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbitrCVE-2024-14032 · Other software · Twitch · reported by VulnCheckHigh 8.5
Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbitrary code as root by exploiting an unprotected XPC service. Attackers can invoke the installFromPath:toPath:withReply: method to overwrite system files and privileged binaries, achieving full system compromise. Twitch Studio was discontinued in May 2024.
- Product
- Twitch Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.twitch.tvhelp.twitch.tv
Mar 30, 2026Device Monitoring Studio 8.10.00.8925 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessivelCVE-2019-25655 · Other software · hdd · reported by VulnCheckMedium 6.9
Device Monitoring Studio 8.10.00.8925 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string to the server connection dialog. Attackers can trigger the crash by entering a malformed server name or address containing repeated characters through the Tools menu Connect to New Server interface.
- Product
- Device Monitoring Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Mar 30, 2026Valentina Studio 9.0.4 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string iCVE-2018-25227 · Other software · Valentina-Db · reported by VulnCheckMedium 6.9
Valentina Studio 9.0.4 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Host field. Attackers can trigger the crash by pasting a 256-byte buffer of repeated characters into the Host parameter during server connection attempts.
- Product
- Valentina Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvalentina-db.comvalentina-db.com
Mar 26, 2026Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.CVE-2026-30463 · Other software · Thedaylightstudio · reported by MITREHigh 7.7
Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.CVE-2026-30458 · Other software · Thedaylightstudio · reported by MITRECritical 9.1
An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compentest-tools.com
Mar 26, 2026An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.CVE-2026-30457 · Other software · Thedaylightstudio · reported by MITRECritical 9.8
An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.
- Product
- Dwoo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compentest-tools.com
Mar 24, 2026Vulnerable endpoints accept user-controlled input through a URL in JSON format which enables command execution.CVE-2025-11571 · Other software · silabs.com · reported by product-security@silabs.comLow 2.1
Vulnerable endpoints accept user-controlled input through a URL in JSON format which enables command execution. The commands allowed to execute can open executables. However, the commands cannot pass parameters or arguments. To successfully execute this attack, the attacker needs to be on the same network.
- Product
- Simplicity Studio v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge uCVE-2026-0898 · Other software · Pegasystems · reported by security@pega.comCritical 9
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25. This vulnerability does not affect Robot Runtime users. A bad actor could create a website that includes malicious code. The vulnerability may be exploited if a Pega Robot Studio developer is deceived into visiting this website during interrogation mode in Robot Studio.
- Product
- Pega Robot Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Blob Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the key enCVE-2019-25625 · Other software · Pixarra · reported by VulnCheckMedium 6.9
Blob Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the key entry mechanism. Attackers can create a text file with a large buffer of repeated characters and trigger the application to read it, causing the application to crash or become unresponsive.
- Product
- Blob Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpixarra.compixarra.com
Mar 23, 2026Liquid Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keybCVE-2019-25624 · Other software · Pixarra · reported by VulnCheckMedium 6.9
Liquid Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can trigger the vulnerability by entering arbitrary characters during application runtime, causing the application to become unresponsive or terminate abnormally.
- Product
- Liquid Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpixarra.compixarra.com
Mar 23, 2026Luminance Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the kCVE-2019-25623 · Other software · Pixarra · reported by VulnCheckMedium 6.9
Luminance Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can create a text file with arbitrary character sequences and trigger the application to process the input, causing the application to become unresponsive or terminate abnormally.
- Product
- Luminance Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpixarra.compixarra.com
Mar 23, 2026Paint Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the key eCVE-2019-25622 · Other software · Pixarra · reported by VulnCheckMedium 6.9
Paint Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the key entry mechanism. Attackers can create a text file with a large buffer of characters and trigger the application to read it, causing the application to crash and become unavailable.
- Product
- Paint Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpixarra.compixarra.com
Mar 23, 2026Pixel Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboCVE-2019-25621 · Other software · Pixarra · reported by VulnCheckMedium 6.9
Pixel Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can trigger the vulnerability by entering arbitrary characters, causing the application to become unresponsive or terminate abnormally.
- Product
- Pixel Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpixarra.compixarra.com
Mar 23, 2026Tree Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboaCVE-2019-25620 · Other software · Pixarra · reported by VulnCheckMedium 6.9
Tree Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can trigger the vulnerability by entering arbitrary characters during application runtime, causing the application to become unresponsive or terminate abnormally.
- Product
- Tree Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpixarra.compixarra.com
Mar 21, 2026Valentina Studio 9.0.5 Linux contains a buffer overflow vulnerability in the Host field of the connection dialog that allows local attackers to crash the applicCVE-2019-25567 · Other software · Valentina-Db · reported by VulnCheckMedium 6.9
Valentina Studio 9.0.5 Linux contains a buffer overflow vulnerability in the Host field of the connection dialog that allows local attackers to crash the application by supplying an oversized input string. Attackers can trigger the vulnerability by pasting a crafted buffer exceeding 264 bytes into the Host field during server connection attempts, causing a denial of service.
- Product
- Valentina Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvalentina-db.comexploit-db.com
Mar 21, 2026Selfie Studio 2.17 contains a denial of service vulnerability in the Resize Image function that allows local attackers to crash the application by supplying an CVE-2019-25558 · Other software · Pixarra · reported by VulnCheckMedium 6.9
Selfie Studio 2.17 contains a denial of service vulnerability in the Resize Image function that allows local attackers to crash the application by supplying an excessively long buffer. Attackers can paste a large string of characters into the New Width or New Height field to trigger a buffer overflow that crashes the application.
- Product
- Selfie Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpixarra.comexploit-db.com
Mar 21, 2026TwistedBrush Pro Studio 24.06 contains a denial of service vulnerability that allows local attackers to crash the application by importing a malformed .srp scriCVE-2019-25557 · Other software · Pixarra · reported by VulnCheckMedium 6.9
TwistedBrush Pro Studio 24.06 contains a denial of service vulnerability that allows local attackers to crash the application by importing a malformed .srp script file. Attackers can create a .srp file containing an excessively large buffer and import it through the Script Player interface to trigger an application crash.
- Product
- TwistedBrush Pro Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpixarra.comexploit-db.com
Mar 21, 2026TwistedBrush Pro Studio 24.06 contains a denial of service vulnerability in the Resize Image function that allows local attackers to crash the application by suCVE-2019-25556 · Other software · Pixarra · reported by VulnCheckMedium 6.9
TwistedBrush Pro Studio 24.06 contains a denial of service vulnerability in the Resize Image function that allows local attackers to crash the application by supplying an excessively long buffer. Attackers can paste a malicious string into the New Width or New Height field to trigger a buffer overflow that causes the application to crash.
- Product
- TwistedBrush Pro Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpixarra.comexploit-db.com
Mar 21, 2026TwistedBrush Pro Studio 24.06 contains a denial of service vulnerability in the Script Recorder component that allows local attackers to crash the application bCVE-2019-25555 · Other software · Pixarra · reported by VulnCheckMedium 6.9
TwistedBrush Pro Studio 24.06 contains a denial of service vulnerability in the Script Recorder component that allows local attackers to crash the application by supplying an excessively large buffer. Attackers can paste a malicious string containing 500,000 characters into the Description field of the Script Recorder dialog to trigger an application crash.
- Product
- TwistedBrush Pro Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpixarra.comexploit-db.com
Mar 18, 2026StudioCMS is a server-side-rendered, Astro native, headless content management system.CVE-2026-32638 · Other software · withstudiocms · reported by GitHubLow 2.7
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in StudioCMS uses the attacker-controlled `rank` query parameter to decide whether owner accounts should be filtered from the result set. As a result, an admin token can request `rank=owner` and receive owner account records, including IDs, usernames, display names, and email addresses, even though the adjacent `getUser` endpoint correctly blocks admins from viewing owner users. This is an authorization inconsistency inside the same user-management surface. Version 0.4.4 fixes the issue.
- Product
- studiocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Lean 4 VS Code Extension is a Visual Studio Code extension for the Lean 4 proof assistant.CVE-2026-32732 · Other software · leanprover · reported by GitHubNone
Lean 4 VS Code Extension is a Visual Studio Code extension for the Lean 4 proof assistant. Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as unescaped HTML. The issue has been resolved in 0.2.0.
- Product
- vscode-lean4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026Studio99 WP Monitor: Missing AuthorizationCVE-2026-32404 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Studio99 Studio99 WP Monitor studio99-wp-monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Studio99 WP Monitor: from n/a through <= 1.0.3.
- Product
- Studio99 WP Monitor
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Studio99 WP Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2026StudioCMS is a server-side-rendered, Astro native, headless content management system.CVE-2026-32106 · Other software · withstudiocms · reported by GitHubMedium 4.7
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank. This inconsistency allows an admin to create additional admin accounts via the REST API, enabling privilege proliferation and persistence. This vulnerability is fixed in 0.4.3.
- Product
- studiocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026StudioCMS is a server-side-rendered, Astro native, headless content management system.CVE-2026-32104 · Other software · withstudiocms · reported by GitHubMedium 5.4
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user's notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (id !== userData.user.id). Any authenticated visitor can modify notification preferences for any user, including disabling admin notifications to suppress detection of malicious activity. This vulnerability is fixed in 0.4.3.
- Product
- studiocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026StudioCMS is a server-side-rendered, Astro native, headless content management system.CVE-2026-32103 · Other software · withstudiocms · reported by GitHubMedium 6.8
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account. The handler verifies that the caller is an admin but does not enforce role hierarchy, nor does it validate that the target userId matches the caller's identity. Combined with the POST /studiocms_api/dashboard/reset-password endpoint, this allows a complete account takeover of the highest-privileged account in the system. This vulnerability is fixed in 0.4.3.
- Product
- studiocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026StudioCMS is a server-side-rendered, Astro native, headless content management system.CVE-2026-32101 · Other software · @studiocms · reported by GitHubHigh 7.6
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized() function is declared async (returns Promise<boolean>) but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorized(type) always evaluates to false, completely bypassing the authorization check. Any authenticated user with the lowest visitor role can upload, delete, rename, and list all files in the S3 bucket. This vulnerability is fixed in 0.3.1.
- Product
- s3-storage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026StudioCMS is a server-side-rendered, Astro native, headless content management system.CVE-2026-30945 · Other software · withstudiocms · reported by GitHubHigh 7.1
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy. This enables targeted denial of service against critical integrations and automations. This vulnerability is fixed in 0.4.0.
- Product
- studiocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026StudioCMS is a server-side-rendered, Astro native, headless content management system.CVE-2026-30944 · Other software · withstudiocms · reported by GitHubHigh 8.8
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target user ID, resulting in a full privilege escalation. This vulnerability is fixed in 0.4.0.
- Product
- studiocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credeCVE-2026-3432 · Other software · SimStudioAI · reported by vulnreport@tenable.comCritical 9.3
On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying their user ID and a provider name, effectively stealing credentials to third-party services.
- Product
- sim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.