Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
682 results · page 4 of 14
Apr 20, 2026python-dotenv reads key-value pairs from a .env file and can set them as environment variables.CVE-2026-28684 · Other software · theskumar · reported by GitHubMedium 6.6
python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.
- Product
- python-dotenv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages.CVE-2026-34264 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low privileges could guess and enumerate the content shown, beyond their authorized scope. This leads to disclosure of sensitive information causing a high impact on confidentiality, while integrity and availability are unaffected.
- Product
- SAP Human Capital Management for SAP S/4HANA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026A flaw was found in Red Hat Quay's handling of resumable container image layer uploads.CVE-2026-32590 · Other software · Red Hat · reported by Red HatHigh 7.1
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
- Product
- mirror registry for Red Hat OpenShift 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Apr 7, 2026OrangeHRM is a comprehensive human resource management (HRM) system.CVE-2026-39349 · Other software · orangehrm · reported by GitHubLow 2.1
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB mode, which preserves block-aligned plaintext patterns in ciphertext and enables pattern disclosure against stored data. This vulnerability is fixed in 5.8.1.
- Product
- orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026OrangeHRM is a comprehensive human resource management (HRM) system.CVE-2026-39348 · Other software · orangehrm · reported by GitHubMedium 5.3
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source omits authorization on job specification and vacancy attachment download handlers, allowing authenticated low-privilege users to read attachments via direct reference to attachment identifiers. This vulnerability is fixed in 5.8.1.
- Product
- orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026OrangeHRM is a comprehensive human resource management (HRM) system.CVE-2026-39347 · Other software · orangehrm · reported by GitHubMedium 5.1
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for administrator users after those submissions have been marked completed, breaking integrity of finalized appraisal records. This vulnerability is fixed in 5.8.1.
- Product
- orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026OrangeHRM is a comprehensive human resource management (HRM) system.CVE-2026-39346 · Other software · orangehrm · reported by GitHubMedium 5.3
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source allowed authenticated users to bypass disabled-module access controls via URL-encoded request paths and access functionality of modules disabled by an administrator. This vulnerability is fixed in 5.8.1.
- Product
- orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026OrangeHRM is a comprehensive human resource management (HRM) system.CVE-2026-39345 · Other software · orangehrm · reported by GitHubMedium 4.6
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source fails to restrict email template file resolution to the intended plugins directory, allowing an authenticated actor who can influence the template path to read arbitrary local files. This vulnerability is fixed in 5.8.1.
- Product
- orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs.CVE-2026-34072 · Other software · fccview · reported by GitHubHigh 8.3
Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentication bypass in middleware allows unauthenticated requests with an invalid session cookie to be treated as authenticated when the middleware’s session-validation fetch fails. This can result in unauthorized access to protected pages and unauthorized execution of privileged Next.js Server Actions. This issue has been patched in version 2.2.0.
- Product
- cronmaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026SQL inyection (SQLi) vulnerability in Umami Software web application through an improperly sanitized parameter, which could allow an authenticated attacker to eCVE-2026-4317 · Other software · Umami Software application · reported by cve-coordination@incibe.esCritical 9.3
SQL inyection (SQLi) vulnerability in Umami Software web application through an improperly sanitized parameter, which could allow an authenticated attacker to execute arbitrary SQL commands in the database.Specifically, they could manipulate the value of the 'timezone' request parameter by including malicious characters and SQL payload. The application would interpolate these values directly into the SQL query without first performing proper filtering or sanitization (e.g., using functions such as 'prisma.rawQuery', 'prisma.$queryRawUnsafe' or raw queries with 'ClickHouse'). The successful explotation of this vulnerability could allow an authenticated attacker to compromiso the data of the database and execute dangerous functions.
- Product
- Umami Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Zen C is a systems programming language that compiles to human-readable GNU C/C11.CVE-2026-33491 · Other software · zenc-lang · reported by GitHubHigh 7.8
Zen C is a systems programming language that compiles to human-readable GNU C/C11. Prior to version 0.4.4, a stack-based buffer overflow vulnerability in the Zen C compiler allows attackers to cause a compiler crash or potentially execute arbitrary code by providing a specially crafted Zen C source file (`.zc`) with excessively long struct, function, or trait identifiers. Users are advised to update to Zen C version v0.4.4 or later to receive a patch.
- Product
- zenc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026In the Linux kernel, the following vulnerability has been resolved: bpf: Fix race in cpumap on PREEMPT_RT On PREEMPT_RT kernels, the per-CPU xdp_bulk_queue (bCVE-2026-23342 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 4.7
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix race in cpumap on PREEMPT_RT On PREEMPT_RT kernels, the per-CPU xdp_bulk_queue (bq) can be accessed concurrently by multiple preemptible tasks on the same CPU. The original code assumes bq_enqueue() and __cpu_map_flush() run atomically with respect to each other on the same CPU, relying on local_bh_disable() to prevent preemption. However, on PREEMPT_RT, local_bh_disable() only calls migrate_disable() (when PREEMPT_RT_NEEDS_BH_LOCK is not set) and does not disable preemption, which allows CFS scheduling to preempt a task during bq_flush_to_queue(), enabling another task on the same CPU to enter bq_enqueue() and operate on the same per-CPU bq concurrently. This leads to several races: 1. Double __list_del_clearprev(): after bq->count is reset in bq_flush_to_queue(), a preempting task can call bq_enqueue() -> bq_flush_to_queue() on the same bq when bq->count reaches CPU_MAP_BULK_SIZE. Both tasks then call __list_del_clearprev() on the same bq->flush_node, the second call dereferences the prev pointer that was already set to NULL by the first. 2. bq->count and bq->q[] races: concurrent bq
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 24, 2026Out-of-bounds Read vulnerability in rizonesoft Notepad3 (scintilla/oniguruma/src modules).CVE-2026-4744 · Other software · rizonesoft · reported by cve_disclosure@tech.gov.sgCritical 9.3
Out-of-bounds Read vulnerability in rizonesoft Notepad3 (scintilla/oniguruma/src modules). This vulnerability is associated with program files regcomp.C. This issue affects Notepad3: before 6.25.714.1.
- Product
- Notepad3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Uptime Kuma is an open source, self-hosted monitoring tool.CVE-2026-33130 · Other software · louislam · reported by GitHubMedium 6.5
Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection (SSTI). The three mitigations added to the Liquid engine (root, relativeReference, dynamicPartials) only block quoted paths. If a project uses an unquoted absolute path, attackers can still read any file on the server. The original fix in notification-provider.js only constrains the first two steps of LiquidJS's file resolution (via root, relativeReference, and dynamicPartials options), but the third step, the require.resolve() fallback in liquid.node.js has no containment check, allowing unquoted absolute paths like /etc/passwd to resolve successfully. Quoted paths happen to be blocked only because the literal quote characters cause require.resolve('"/etc/passwd"') to throw a MODULE_NOT_FOUND error, not because of any intentional security measure. This issue has been fixed in version 2.2.1.
- Product
- uptime-kuma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from CVE-2026-23243 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 17, 2026Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenCVE-2026-30911 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Mar 12, 2026Uptime Kuma is an open source, self-hosted monitoring tool.CVE-2026-32230 · Other software · louislam · reported by GitHubMedium 5.3
Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this check entirely, allowing unauthenticated users to extract average ping/response time data for private monitors. This vulnerability is fixed in 2.2.0.
- Product
- uptime-kuma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026HUMN-1 AI Website Scanner & Human Certification by Winston AI: Unauthorized modification of dataCVE-2026-1981 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HUMN-1 AI Website Scanner & Human Certification by Winston AI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the winston_disconnect() function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's API connection settings via the 'winston_disconnect' AJAX action.
- Product
- HUMN-1 AI Website Scanner & Human Certification by Winston AI
- Affected
- up to 0.0.3
- What to do
- Affects up to 0.0.3. Update HUMN-1 AI Website Scanner & Human Certification by Winston AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 5, 2026Humanum: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27985 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Humanum humanum allows PHP Local File Inclusion.This issue affects Humanum: from n/a through <= 1.1.4.
- Product
- Humanum
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Humanum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2026Zen C is a systems programming language that compiles to human-readable GNU C/C11.CVE-2026-28207 · Other software · z-libs · reported by GitHubMedium 6.6
Zen C is a systems programming language that compiles to human-readable GNU C/C11. Prior to version 0.4.2, a command injection vulnerability (CWE-78) in the Zen C compiler allows local attackers to execute arbitrary shell commands by providing a specially crafted output filename via the `-o` command-line argument. The vulnerability existed in the `main` application logic (specifically in `src/main.c`), where the compiler constructed a shell command string to invoke the backend C compiler. This command string was built by concatenating various arguments, including the user-controlled output filename, and was subsequently executed using the `system()` function. Because `system()` invokes a shell to parse and execute the command, shell metacharacters within the output filename were interpreted by the shell, leading to arbitrary command execution. An attacker who can influence the command-line arguments passed to the `zc` compiler (like through a build script or a CI/CD pipeline configuration) can execute arbitrary commands with the privileges of the user running the compiler. The vulnerability has been fixed in version 0.4.2 by removing `system()` calls, implementing `ArgList`, and in
- Product
- Zen-C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comf0nduesav0yarde.github.io
Feb 24, 2026tfplan2md is software for converting Terraform plan JSON files into human-readable Markdown reports.CVE-2026-27640 · Other software · oocx · reported by GitHubHigh 8.5
tfplan2md is software for converting Terraform plan JSON files into human-readable Markdown reports. Prior to version 1.26.1, a bug in tfplan2md affected several distinct rendering paths: AzApi resource body properties, AzureDevOps variable groups, Scriban template context variables, and hierarchical sensitivity detection. This caused reports to render values that should have been masked as "(sensitive)" instead. This issue is fixed in v1.26.1. No known workarounds are available.
- Product
- tfplan2md
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A vulnerability was identified in higuma web-audio-recorder-js 0.1/0.1.1.CVE-2026-2964 · Other software · higuma · reported by VulDBLow 1.3
A vulnerability was identified in higuma web-audio-recorder-js 0.1/0.1.1. Impacted is the function extend in the library lib/WebAudioRecorder.js of the component Dynamic Config Handling. Such manipulation leads to improperly controlled modification of object prototype attributes. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- web-audio-recorder-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026SumatraPDF is a multi-format reader for Windows.CVE-2026-25961 · Other software · sumatrapdfreader · reported by GitHubHigh 7.5
SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and executes installers without signature checks. A network attacker with any valid TLS certificate (e.g., Let's Encrypt) can intercept the update check request, inject a malicious installer URL, and achieve arbitrary code execution.
- Product
- sumatrapdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026SumatraPDF is a multi-format reader for Windows.CVE-2026-25920 · Other software · sumatrapdfreader · reported by GitHubMedium 5.5
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, a heap out-of-bounds read vulnerability exists in SumatraPDF's MOBI HuffDic decompressor. The bounds check in AddCdicData() only validates half the range that DecodeOne() actually accesses. Opening a crafted .mobi file can read nearly (1 << codeLength) bytes beyond the CDIC dictionary buffer, leading to a crash.
- Product
- sumatrapdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026SumatraPDF is a multi-format reader for Windows.CVE-2026-25880 · Other software · sumatrapdfreader · reported by GitHubHigh 7.8
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, the PDF reader allows execution of a malicious binary (explorer.exe) located in the same directory as the opened PDF when the user clicks File → “Show in folder”. This behavior leads to arbitrary code execution on the victim’s system with the privileges of the current user, without any warning or user interaction beyond the menu click.
- Product
- sumatrapdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026Sistem Informasi Pengumuman Kelulusan Online 1.0 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized admin users throuCVE-2020-37046 · Other software · Adikiss · reported by VulnCheckMedium 5.1
Sistem Informasi Pengumuman Kelulusan Online 1.0 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized admin users through the tambahuser.php endpoint. Attackers can craft a malicious HTML form to submit admin credentials and create new administrative accounts without the victim's consent.
- Product
- Sistem Informasi Pengumuman Kelulusan Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadikiss.netadikiss.net
Jan 30, 2026LobeHub is an open source human-and-AI-agent network.CVE-2026-23835 · Other software · lobehub · reported by GitHubMedium 5.7
LobeHub is an open source human-and-AI-agent network. Prior to version 1.143.3, the file upload feature in `Knowledge Base > File Upload` does not validate the integrity of the upload request, allowing users to intercept and modify the request parameters. As a result, it is possible to create arbitrary files in abnormal or unintended paths. In addition, since `lobechat.com` relies on the size parameter from the request to calculate file usage, an attacker can manipulate this value to misrepresent the actual file size, such as uploading a `1 GB` file while reporting it as `10 MB`, or falsely declaring a `10 MB` file as a `1 GB` file. By manipulating the size value provided in the client upload request, it is possible to bypass the monthly upload quota enforced by the server and continuously upload files beyond the intended storage and traffic limits. This abuse can result in a discrepancy between actual resource consumption and billing calculations, causing direct financial impact to the service operator. Additionally, exhaustion of storage or related resources may lead to degraded service availability, including failed uploads, delayed content delivery, or temporary suspension of u
- Product
- lobe-chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Out-of-bounds Read vulnerability in CloverHackyColor CloverBootloader (MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma modules).CVE-2026-24796 · Other software · CloverHackyColor · reported by cve_disclosure@tech.gov.sgMedium 6.9
Out-of-bounds Read vulnerability in CloverHackyColor CloverBootloader (MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma modules). This vulnerability is associated with program files regparse.C. This issue affects CloverBootloader: before 5162.
- Product
- CloverBootloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Out-of-bounds Write vulnerability in CloverHackyColor CloverBootloader (MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma modules).CVE-2026-24795 · Other software · CloverHackyColor · reported by cve_disclosure@tech.gov.sgMedium 5.1
Out-of-bounds Write vulnerability in CloverHackyColor CloverBootloader (MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma modules). This vulnerability is associated with program files regcomp.C. This issue affects CloverBootloader: before 5162.
- Product
- CloverBootloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24039 · Other software · horilla-opensource · reported by GitHubMedium 4.3
Horilla is a free and open source Human Resource Management System (HRMS). Version 1.4.0 has Improper Access Control, allowing low-privileged employees to self-approve documents they have uploaded. The document-approval UI is intended to be restricted to administrator or high-privilege roles only; however, an insufficient server-side authorization check on the approval endpoint lets a standard employee modify the approval status of their own uploaded document. A successful exploitation allows users with only employee-level permissions to alter application state reserved for administrators. This undermines the integrity of HR processes (for example, acceptance of credentials, certifications, or supporting materials), and may enable submission of unvetted documents. This issue is fixed in version 1.5.0.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24038 · Other software · horilla-opensource · reported by GitHubHigh 8.1
Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from their POST request, the user-supplied OTP is also None, causing the comparison user_otp == otp to pass. This allows an attacker to bypass two-factor authentication entirely without ever providing a valid OTP. If administrative accounts are targeted, it could lead to compromise of sensitive HR data, manipulation of employee records, and further system-wide abuse. This issue has been fixed in version 1.5.0.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24037 · Other software · horilla-opensource · reported by GitHubMedium 4.8
Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the has_xss() function attempts to block XSS by matching input against a set of regex patterns. However, the regexes are incomplete and context-agnostic, making them easy to bypass. Attackers are able to redirect users to malicious domains, run external JavaScript, and steal CSRF tokens that can be used to craft CSRF attacks against admins. This issue has been fixed in version 1.5.0.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24036 · Other software · horilla-opensource · reported by GitHubMedium 5.3
Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication. The response includes draft job titles, descriptions and application link allowing unauthenticated users to view unpublished roles and access the application workflow for unpublished jobs. Unauthorized access to unpublished job posts can leak sensitive internal hiring information and cause confusion among candidates. This issue has been fixed in version 1.5.0.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24035 · Other software · horilla-opensource · reported by GitHubMedium 4.3
Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exists in Horilla HR Software starting in version 1.4.0 and prior to version 1.5.0, allowing any authenticated employee to upload documents on behalf of another employee without proper authorization. This occurs due to insufficient server-side validation of the employee_id parameter during file upload operations, allowing any authenticated employee to upload document in behalf of any employee. Version 1.5.0 fixes the issue.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24034 · Other software · horilla-opensource · reported by GitHubMedium 5.4
Horilla is a free and open source Human Resource Management System (HRMS). In versions prior to 1.5.0, a cross-site scripting vulnerability can be triggered because the extension and content-type are not checked during the profile photo update step. Version 1.5.0 fixes the issue.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24010 · Other software · horilla-opensource · reported by GitHubHigh 8
Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload vulnerability in versions prior to 1.5.0, with Social Engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disguised as a profile picture, an attacker can create a convincing login page replica that steals user credentials. When a victim visits the uploaded file URL, they see an authentic-looking "Session Expired" message prompting them to re-authenticate. All entered credentials are captured and sent to the attacker's server, enabling Account Takeover. Version 1.5.0 patches the issue.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026SumatraPDF is a multi-format reader for Windows.CVE-2026-23951 · Other software · sumatrapdfreader · reported by GitHubMedium 5.5
SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exactly 2 records, causing an integer underflow in the size calculation. This bug exists in PalmDbReader::GetRecord when opening a crafted Mobi file, resulting in an out-of-bounds heap read that crashes the app. There are no published fixes at the time of publication.
- Product
- sumatrapdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Company Dir / Org Chart Viewer, Employee Snapshot).CVE-2026-21961 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Company Dir / Org Chart Viewer, Employee Snapshot). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise HCM Human Resources, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- PeopleSoft Enterprise HCM Human Resources
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026SumatraPDF is a multi-format reader for Windows.CVE-2026-23512 · Other software · sumatrapdfreader · reported by GitHubHigh 8.6
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is trigger. The application executes notepad.exe without specifying an absolute path when using the Advanced Options setting. On Windows, this allows execution of a malicious notepad.exe placed in the application's installation directory, leading to arbitrary code execution.
- Product
- sumatrapdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Label Studio is a multi-type data labeling and annotation tool.CVE-2026-22033 · Other software · HumanSignal · reported by GitHubHigh 8.6
Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting (XSS) vulnerability exists in the custom_hotkeys functionality of the application. An authenticated attacker (or one who can trick a user/administrator into updating their custom_hotkeys) can inject JavaScript code that executes in other users’ browsers when those users load any page using the templates/base.html template. Because the application exposes an API token endpoint (/api/current-user/token) to the browser and lacks robust CSRF protection on some API endpoints, the injected script may fetch the victim’s API token or call token reset endpoints — enabling full account takeover and unauthorized API access.
- Product
- label-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices.CVE-2025-68657 · Other software · espressif · reported by GitHubMedium 6.4
Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, calls to hid_host_device_close() can free the same usb_transfer_t twice. The USB event callback and user code share the hid_iface_t state without locking, so both can tear down a READY interface simultaneously, corrupting heap metadata inside the ESP USB host stack. This vulnerability is fixed in 1.1.0.
- Product
- esp-usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcomponents.espressif.comgithub.com
Jan 12, 2026Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices.CVE-2025-68656 · Other software · espressif · reported by GitHubMedium 6.8
Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, usb_class_request_get_descriptor() frees and reallocates hid_device->ctrl_xfer when an oversized descriptor is requested but continues to use the stale local pointer, leading to an immediate use-after-free when processing attacker-controlled Report Descriptor lengths. This vulnerability is fixed in 1.1.0.
- Product
- esp-usb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcomponents.espressif.comgithub.com
Jan 2, 2026A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie.CVE-2025-62857 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2.2
A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QuMagie 2.8.1 and later
- Product
- QuMagie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025In the Linux kernel, the following vulnerability has been resolved: virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs() Free the cpumask allocated CVE-2023-54215 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs() Free the cpumask allocated by create_affinity_masks() before returning from the function.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 16, 2025EduMall: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68061 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a through <= 4.4.7.
- Product
- EduMall
- Affected
- up to 4.4.7
- What to do
- Affects up to 4.4.7. Update EduMall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 4, 2025An issue in the Bluetooth Human Interface Device (HID) of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to inject arbitrary keystrokesCVE-2025-63896 · Other software · Jxlindia · reported by MITREHigh 7.6
An issue in the Bluetooth Human Interface Device (HID) of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to inject arbitrary keystrokes via a spoofed Bluetooth HID device.
- Product
- JXL 9 Inch CAR Android Double DIN Player Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025OrangeHRM is a comprehensive human resource management (HRM) system.CVE-2025-66291 · Other software · orangehrm · reported by GitHubMedium 5.3
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the interview attachment retrieval endpoint in the Recruitment module serves files based solely on an authenticated session and user-supplied identifiers, without verifying whether the requester has permission to access the associated interview record. Because the server does not perform any recruitment-level authorization checks, an ESS-level user with no access to recruitment workflows can directly request interview attachment URLs and receive the corresponding files. This exposes confidential interview documents—including candidate CVs, evaluations, and supporting files—to unauthorized users. The issue arises from relying on predictable object identifiers and session presence rather than validating the user’s association with the relevant recruitment process. This issue has been patched in version 5.8.
- Product
- orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025OrangeHRM is a comprehensive human resource management (HRM) system.CVE-2025-66290 · Other software · orangehrm · reported by GitHubMedium 5.3
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application’s recruitment attachment retrieval endpoint does not enforce the required authorization checks before serving candidate files. Even users restricted to ESS-level access, who have no permission to view the Recruitment module, can directly access candidate attachment URLs. When an authenticated request is made to the attachment endpoint, the system validates the session but does not confirm that the requesting user has the necessary recruitment permissions. As a result, any authenticated user can download CVs and other uploaded documents for arbitrary candidates by issuing direct requests to the attachment endpoint, leading to unauthorized exposure of sensitive applicant data. This issue has been patched in version 5.8.
- Product
- orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025OrangeHRM is a comprehensive human resource management (HRM) system.CVE-2025-66289 · Other software · orangehrm · reported by GitHubHigh 8.7
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user is disabled or when a password change occurs, allowing active session cookies to remain valid indefinitely. As a result, a disabled user, or an attacker using a compromised account, can continue to access protected pages and perform operations as long as a prior session remains active. Because the server performs no session revocation or session-store cleanup during these critical state changes, disabling an account or updating credentials has no effect on already-established sessions. This makes administrative disable actions ineffective and allows unauthorized users to retain full access even after an account is closed or a password is reset, exposing the system to prolonged unauthorized use and significantly increasing the impact of account takeover scenarios. This issue has been patched in version 5.8.
- Product
- orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025OrangeHRM is a comprehensive human resource management (HRM) system.CVE-2025-66225 · Other software · orangehrm · reported by GitHubHigh 8.7
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username submitted in the final reset request matches the account for which the reset process was originally initiated. After obtaining a valid reset link for any account they can receive email for, an attacker can alter the username parameter in the final reset request to target a different user. Because the system accepts the supplied username without verification, the attacker can set a new password for any chosen account, including privileged accounts, resulting in full account takeover. This issue has been patched in version 5.8.
- Product
- orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.