Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

1,131 results · page 4 of 23

Aug 14, 2026A flaw was found in Red Hat Quay's exported logs feature.CVE-2026-74245 · Other software · Red Hat · reported by Red HatMedium 5.9
A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to information disclosure, potentially exposing sensitive data such as usernames, email addresses, IP addresses, and action-specific metadata.
Product
Red Hat OpenShift Update Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Aug 12, 2026Ezoic: Does not properly restrict access to some of its content export functionalityCVE-2026-18789 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.
Product
Ezoic
Fixed in
2.23.1
What to do
Update Ezoic to 2.23.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Import WP: Does not perform any authorization check on one of its export-file download handlersCVE-2026-14925 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based download key to be obtained.
Product
Import WP
Fixed in
2.14.23
What to do
Update Import WP to 2.14.23 or newer.
Full record and what to do →NVD record wpscan.com
Aug 11, 2026tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScriCVE-2026-9318 · Other software · Jazzband · reported by VulnCheckMedium 4.8
tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the export_book method in the _html.py format handler. Attackers can rename worksheet sheets in imported files such as XLSX, ODS, XLS, or YAML with script payloads that are assigned to the Dataset title attribute and rendered unescaped inside an HTML h3 tag, leading to session hijacking, unauthorized administrative actions, and sensitive data exposure when the output is rendered in a browser.
Product
tablib
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 11, 2026Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports.CVE-2026-73140 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 5.3
Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges, build_evaluation_report() previously included all evaluation comments without applying those rules. Consequently, a user who was authorized to view a conversion could export its evaluation report as Markdown or PDF and obtain private evaluation comments that should only have been visible to the conversion owner, the comment author, or an administrator. The leaked report data also contained the comment author's name. The fix passes the requesting user into the report builder and filters every evaluation comment using the shared access.can_see_comment() authorization function.
Product
cti-transmute
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Aug 10, 2026Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information.CVE-2026-21081 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.1
Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.
Product
SamsungPassAutofill
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Aug 10, 2026Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function.CVE-2026-21063 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.8
Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Aug 10, 2026Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung ContactCVE-2026-21059 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.9
Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Aug 7, 2026In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OCVE-2026-47363 · Other software · Datadog · reported by support@hackerone.comMedium 6.3
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim's app. Impact: A co-installed application can switch the victim's Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim's existing session or data.
Product
Android App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwe.mitre.org trust.datadoghq.com
Aug 7, 2026In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a calCVE-2026-47361 · Other software · Datadog · reported by support@hackerone.comMedium 6.4
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversation_id. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ID 9201 (the Bits AI chat notification), with no check on the caller's identity or ownership of the conversation. This requires a malicious application co-installed on the victim's device. Impact: A co-installed application can silently dismiss the victim's Bits AI chat notification. No chat content is exposed; conversation data remains server-authentication gated and is never returned to the caller.
Product
Android App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwe.mitre.org trust.datadoghq.com
Aug 7, 2026In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard.CVE-2026-44964 · Other software · Datadog · reported by support@hackerone.comMedium 6.5
In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process. This requires: A malicious application co-installed on the victim's device. An active Datadog session in the Android app. Impact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim's session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard.
Product
Android App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.android.com trust.datadoghq.com
Aug 6, 2026Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions.CVE-2026-66684 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions.
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.CVE-2026-65552 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026tourmaster: Writes its order/booking export to a fixedCVE-2026-14240 · WordPress plugins & themes · reported by WPScanMedium 5.3
The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.
Product
tourmaster
Fixed in
5.4.9
What to do
Update tourmaster to 5.4.9 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an aCVE-2026-6837 · Network & remote access · Zyxel · reported by security@zyxel.com.twHigh 7.2
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
Product
WAX650S firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zyxel.com
Aug 3, 2026Import and export users and customers: Does not enforce WordPress's role-assignment and per-user edit permissions during CSV importCVE-2026-16534 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.
Product
Import and export users and customers
Fixed in
2.4.2
What to do
Update Import and export users and customers to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Import and export users and customers: Does not restrict the path of a file it reads and displays during a CSV importCVE-2025-15673 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.
Product
Import and export users and customers
Fixed in
2.4.3
What to do
Update Import and export users and customers to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from tCVE-2026-59231 · Other software · ccyl13 · reported by 4daa8cea-433a-44bd-9456-53b127fc289aMedium 5.3
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report client_logo field, which the server-side headless browser fetches while rendering the report.
Product
Pentestify
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 31, 2026pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendCVE-2026-17566 · Other software · pgadmin.org · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Critical 9.4
pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/<sid>, gated only by the ordinary, commonly-granted tools_import_export_data permission) validated the query with a hand-written parenthesis-balance checker, _is_query_parens_balanced(). That checker always treated a backslash before a single quote (\') as escaping the quote, i.e. as if standard_conforming_strings were off. PostgreSQL has defaulted standard_conforming_strings to on since 9.1 (2010), the default on every PostgreSQL version pgAdmin 4 currently supports (13-18); under that default psql's own \copy tokenizer treats \ as an ordinary character, so a single quote immediately after it closes the string literal. A query such as SELECT 'a\') TO PROGRAM 'echo pwned' x' was therefore accepted as "balanced" by pgAdmin's checker (which believed the ) was still inside the string), while psql, run through the actual rendered command line, closes the string at that point and t
Product
pgAdmin 4
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 31, 2026Paid Membership Subscriptions: Does not protect the member and payment export files it writes to a predictable location in the uploads directoryCVE-2026-14849 · WordPress plugins & themes · reported by WPScanLow 3.7
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present.
Product
Paid Membership Subscriptions
Fixed in
3.0.7
What to do
Update Paid Membership Subscriptions to 3.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 28, 2026NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption bCVE-2026-47483 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.2
NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption by submitting concurrent unauthenticated profiling requests. A successful exploit of this vulnerability might lead to denial of service and information disclosure.
Product
DCGM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com nvd.nist.gov
Jul 23, 2026SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go).CVE-2026-65607 · Other software · siyuan-note · reported by VulnCheckHigh 7.1
SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.
Product
siyuan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 22, 2026Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extensionCVE-2026-63684 · Websites & servers · reported by security@joomla.orgHigh 8.8
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and items.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record regularlabs.com
Jul 22, 2026In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticaCVE-2026-13192 · Other software · Progress Software · reported by security@progress.comMedium 6.5
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of Windows authentication credentials.
Product
Telerik UI for ASP.NET AJAX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record telerik.com
Jul 21, 2026Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export).CVE-2026-62527 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.3
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Learning Management accessible data as well as unauthorized read access to a subset of Oracle Learning Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Learning Management. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Product
Oracle Learning Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Jul 21, 2026Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export).CVE-2026-61249 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Learning Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Product
Oracle Learning Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Jul 20, 2026Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`).CVE-2026-58482 · Other software · Jovancoding · reported by GitHubMedium 5.9
Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets `Access-Control-Allow-Origin: *` on every route, including the state-changing `POST /approvals/:id/approve` and `/deny`. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port — a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) — can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. `ApprovalInbox` now accepts a `secret` option. When set, the mutating endpoints `POST /:id/approve` and `POST /:id/deny` require an `Authorization: Be
Product
Network-AI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 19, 2026In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Check BAR resources before exporting a DMABUF A DMABUF exports access to BAR resCVE-2026-64042 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.8
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Check BAR resources before exporting a DMABUF A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved before exporting. Otherwise, it's possible to access unreserved resources through the export. Add a check to the DMABUF-creation path.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jul 18, 2026Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the device via the android.intent.action.SEND intCVE-2026-57848 · Other software · stoatchat · reported by VulnCheckMedium 6.8
Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the device via the android.intent.action.SEND intent) and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does not validate or filter the incoming URI before using it as the outgoing attachment, so a caller can pass a file:// URI pointing at the application's own internal storage (for example /data/data/chat.revolt/databases/revolt.db, cached authentication token files, or preferences) and have the app treat that internal file as a user-selected attachment. An attacker who can invoke intents on the victim's device (via ADB access, a co-installed malicious application, or any other route that reaches Android's intent dispatch) can launch ShareTargetActivity with such a URI and cause the victim, on a single channel-selection interaction, to send the internal file to any Stoat channel or user of the attacker's choosing. The composer displays the attachment as \"attachment\" with no filename indication, so the victim has no visible signal that the file being sent is their own internal application data. Consequences includ
Product
Stoat for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 18, 2026SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command.CVE-2025-71392 · Other software · surrealdb · reported by VulnCheckCritical 9.4
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.
Product
surrealdb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jul 17, 2026Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of aCVE-2026-63101 · Other software · fossasia · reported by VulnCheckHigh 8.7
Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of any group, including email addresses, names, join dates, and roles, by submitting requests to the group followers CSV export endpoint which lacks any authentication decorator. Attackers can enumerate sequential group IDs via brute-force, trigger an export via the unauthenticated POST endpoint, then poll the unauthenticated task status endpoint until completion to retrieve a download URL containing the full member CSV.
Product
open-event-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jul 17, 2026Ninja Forms - Excel Export: Stored Cross-Site ScriptingCVE-2026-15161 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.6. This is due to the save_filter() AJAX handler storing the raw $_POST['filter'] array into a WordPress option via update_option() without any capability check, nonce verification, or input sanitization, combined with the get_filter_row() method on the admin Excel Export screen concatenating the stored filter values (field_key, condition, value) directly into HTML attributes without esc_attr(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ninja Forms - Excel Export
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Ninja Forms - Excel Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 17, 2026Ninja Forms - Excel Export: Directory TraversalCVE-2026-15160 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_tmp_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to write .xls/.xlsx files to arbitrary locations on the server, which can be used to stage further attacks.
Product
Ninja Forms - Excel Export
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Ninja Forms - Excel Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026Ninja Forms - Excel Export: Insecure Direct Object ReferenceCVE-2026-15159 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_form_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate any Ninja Forms form ID and download all stored submission data — including names, email addresses, phone numbers, physical addresses, and any other PII collected by site forms — as a downloadable XLSX file.
Product
Ninja Forms - Excel Export
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Ninja Forms - Excel Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 16, 2026OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by coCVE-2026-62238 · Other software · openremote · reported by VulnCheckHigh 7.2
OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data exfiltration.
Product
openremote
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jul 16, 2026OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust callers to accessCVE-2026-62211 · Other software · OpenClaw · reported by VulnCheckMedium 4.1
OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust callers to access data that should remain within trusted boundaries. Attackers can exploit misconfigured input paths or feature accessibility to expose sensitive credentials and data through the export mechanism.
Product
OpenClaw
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jul 11, 2026WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel: Remote Code ExecutionCVE-2026-13353 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.0.1 via the 'MappedFields' parameter. This is due to missing capability checks on the AJAX handlers for install_addon, saveMappedFields, and StartImport, combined with the plugin nonce being exposed to any authenticated user who can load an admin page, allowing a Subscriber to install the Import WooCommerce add-on, persist attacker-controlled PHP expressions in the MappedFields parameter, and trigger evaluation via eval() in ImportHelpers::get_meta_values(). This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server.
Product
WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel
Affected
up to 8.0.1
What to do
Affects up to 8.0.1. Update WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.CVE-2026-57961 · Websites & servers · phpMyFAQ · reported by VulnCheckMedium 5.1
phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php. A user with FAQ editing privileges can store HTML containing crafted image paths that are processed during PDF generation. The path resolution logic locates the substring "content" within a user-controlled path using strpos(); when "content" is absent, strpos() returns false, which becomes 0 when cast to an integer, preserving the entire attacker-controlled path. This path is later passed to file_get_contents() without canonicalization or root-directory containment validation, which may allow reading of files outside the intended content directory.
Product
phpMyFAQ
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jul 10, 2026Import and export users and customers: Sensitive Information ExposureCVE-2026-15026 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the email_template_selected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the post_title and raw post_content of arbitrary posts regardless of status (draft, private, future, trash, password-protected) or post type (including non-public CPTs such as WooCommerce orders and internal CRM records) by enumerating post IDs. The required codection-security nonce is exposed as inline JavaScript on any wp-admin page when ?post_type=acui_email_template is appended to the URL, which is reachable by any authenticated user including Subscribers.
Product
Import and export users and customers
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege.CVE-2026-21055 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 8.5
Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege.
Product
Bixby
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Jul 10, 2026Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data.CVE-2026-21054 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.9
Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data.
Product
InputSharing
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Jul 10, 2026Post Export Import with Media: Arbitrary File UploadCVE-2026-13430 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post Export Import with Media plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.13.1 via the import_media_file_secure function. This is due to insufficient file extension validation caused by a trailing-dot filename bypass, where the extension allow-list check in ajax_import_media_start() uses pathinfo() on the raw ZIP entry name (e.g., 'shell.php.'), which returns an empty string for the extension, causing the allow-list guard to be skipped and the file to be extracted to a temporary location, after which import_media_file_secure() copies it into the WordPress uploads directory without re-validating the extension. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.
Product
Post Export Import with Media
Affected
up to 1.13.1
What to do
Affects up to 1.13.1. Update Post Export Import with Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported.CVE-2025-63579 · Other software · reported by MITREHigh 7.5
Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming data ian be bypassed with this vulnerability, allowing encrypted data to be decrypted. Passwords and other sensitive information can be obtained. This affects Kyocera Command Center RX TASKalfa 2552ci, TASKalfa 3252ci, TASKalfa 2553ci, TASKalfa 3253ci, TASKalfa 3554ci, TASKalfa 4052ci, TASKalfa 5052ci, TASKalfa 6052ci, TASKalfa 7052ci, TASKalfa 8052ci, TASKalfa 7353ci, TASKalfa 8353ci, TASKalfa 2554ci, TASKalfa 3254ci, TASKalfa 505.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com global.kyocera.com
Jul 7, 2026An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.CVE-2026-48948 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.4
An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.
Product
Joomla! CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org
Jul 3, 2026WP Import Export Lite: Server-Side Request ForgeryCVE-2026-11397 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpie_import_upload_file_from_url AJAX action. The plugin's URL downloader first calls wp_safe_remote_get() (which correctly blocks private/reserved IP ranges), but when that call returns a WP_Error — the exact outcome for any blocked internal host — the Download::download_file() method falls back to GuzzleHttp\Client::request() with the original attacker-supplied URL and no SSRF protection (and with TLS verification disabled). This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services such as the cloud metadata endpoint at 169.
Product
WP Import Export Lite
Affected
up to 3.9.30
What to do
Affects up to 3.9.30. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted InteCVE-2026-12960 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 6
An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open an specified URL. Refer to the ' Security Update for ASUS Router Android App ' section on the ASUS Security Advisory for more information.
Product
Router app
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record asus.com
Jul 1, 2026MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload.CVE-2026-53906 · Other software · MyComplianceOffice · reported by cvd@cert.plMedium 5.1
MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename parameter allows writing files to arbitrary locations as well as indirect disclosure of absolute server paths through error messages. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
Product
MCO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl mco.mycomplianceoffice.com
Jun 30, 2026JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokCVE-2026-58375 · Other software · jeecgboot · reported by VulnCheckHigh 8.7
JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id without verifying the auto-export configuration flag. An unauthenticated remote attacker can enumerate Snowflake report identifiers and export the full contents of any report, including the data returned by the report configured SQL queries and any credentials embedded in its data sources.
Product
jimureport
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jun 30, 2026Fluent Booking: Does not verify ownership of the requested group_id before exporting attendee data via the export endpointCVE-2026-9576 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.
Product
Fluent Booking
Fixed in
2.1.2
What to do
Update Fluent Booking to 2.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Jun 30, 2026Export User Data: Arbitrary file deletionCVE-2026-12240 · WordPress plugins & themes · reported by WordfenceHigh 8
The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to trigger a user data export while a subscriber-level (or higher) user has stored a crafted serialized XLSXWriter object payload as their display name.
Product
Export User Data
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update Export User Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.