Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
850 results · page 4 of 17
Jun 4, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-41065 · Other software · Tautulli · reported by GitHubHigh 8.9
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before the setup wizard is completed, all management endpoints are completely unauthenticated. An attacker can create a newsletter agent, point the custom template directory to an attacker-controlled SMB share serving a malicious Mako template, and trigger execution via the newsletter render endpoint, all with zero credentials and no local access to the target system. On a completed install with credentials configured, the same chain is exploitable by any admin. Version 2.17.1 fixes the issue.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-40605 · Other software · Tautulli · reported by GitHubMedium 5.7
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.1, a path traversal vulnerability in the cache deletion endpoint allows authenticated API access to delete directories outside the configured cache path. This can cause arbitrary data loss and service disruption. Version 2.17.1 fixes the issue.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2026Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain a denial-of-service vulnerability in all software versions that allowsCVE-2019-25720 · Other software · Dräger · reported by VulnCheckHigh 7.1
Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain a denial-of-service vulnerability in all software versions that allows unauthenticated attackers to reboot the monitor by sending a malformed network packet. Attackers can repeatedly send such malformed packets to disrupt patient monitoring until the device falls back to default configuration and loses network connectivity.
- Product
- SC 6002XL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstatic.draeger.comvulncheck.com
Jun 2, 2026Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded plaintext credentials in source code and a denial-of-servicCVE-2019-25722 · Other software · Dräger · reported by VulnCheckHigh 7.2
Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded plaintext credentials in source code and a denial-of-service vulnerability that allows local and remote attackers to compromise device integrity across all software versions. A local attacker with direct device access can use the hard-coded credentials to access service and clinical accounts and alter device configuration, while a remote attacker can send malformed network packets to cause repeated device reboots, ultimately resulting in loss of network connectivity and disruption of patient monitoring.
- Product
- SC 6002XL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstatic.draeger.comvulncheck.com
May 27, 2026OneUptime is an open-source monitoring and observability platform.CVE-2026-45102 · Other software · OneUptime · reported by GitHubCritical 9.9
OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm module as an isolation primitive. This API was not designed for that and can be escaped via error objects and infinite recursion. This vulnerability is fixed in 10.0.98.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026Pi.Alert is a WIFI / LAN intruder detector with web service monitoring.CVE-2026-44888 · Other software · leiweibau · reported by GitHubCritical 9.8
Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's SaveConfigFile() endpoint writes user-supplied numeric config values (e.g., SMTP_PORT) directly into pialert.conf without validation. Since pialert.conf is loaded via Python's exec() every 3–5 minutes by the background cron process, an attacker can inject arbitrary Python code and achieve unauthenticated OS-level RCE. On default installations (PIALERT_WEB_PROTECTION = False), no credentials are required. This vulnerability is fixed in 2026-05-07.
- Product
- Pi.Alert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026Pi.Alert is a WIFI / LAN intruder detector with web service monitoring.CVE-2026-44887 · Other software · leiweibau · reported by GitHubCritical 9.8
Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's web-based configuration editor allows arbitrary Python code to be injected into pialert.conf. Since the background scan daemon loads this file via Python's exec(), injected code executes as the daemon process. With web protection disabled (the default configuration), no authentication is required, making this an unauthenticated Remote Code Execution vulnerability. This vulnerability is fixed in 2026-05-07.
- Product
- Pi.Alert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026Pi.Alert is a WIFI / LAN intruder detector with web service monitoring.CVE-2026-44886 · Other software · leiweibau · reported by GitHubHigh 8.7
Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is then injected in a SQL query. This vulnerability is fixed in 2026-05-07.
- Product
- Pi.Alert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comprojectblack.io
May 26, 2026Prometheus is an open-source monitoring system and time series database.CVE-2026-44903 · Other software · prometheus · reported by GitHubMedium 5.1
Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3.
- Product
- prometheus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2026A vulnerability was determined in 546669204 vps-inventory-monitoring up to 98c00b370668c96ae75e91c15548d9ea113652d9.CVE-2026-9302 · Other software · 546669204 · reported by VulDBLow 2.1
A vulnerability was determined in 546669204 vps-inventory-monitoring up to 98c00b370668c96ae75e91c15548d9ea113652d9. This issue affects the function eval of the file app/index/command/VpsTest.php of the component VpsTest Console. Executing a manipulation of the argument vf can lead to code injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- vps-inventory-monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Sentry is an error tracking and performance monitoring tool.CVE-2026-42354 · Other software · getsentry · reported by GitHubCritical 9.1
Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical vulnerability was discovered in the SAML SSO implementation of Sentry. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. This issue has been patched in version 26.4.1.
- Product
- sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS.CVE-2022-23961 · Other software · reported by MITREMedium 6.1
In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by unauthenticated remote attackers to target users of the monitoring interface.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
May 4, 2026Prometheus is an open-source monitoring system and time series database.CVE-2026-42154 · Other software · prometheus · reported by GitHubHigh 7.5
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3.
- Product
- prometheus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Prometheus is an open-source monitoring system and time series database.CVE-2026-42151 · Other software · prometheus · reported by GitHubHigh 7.5
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.
- Product
- prometheus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2026GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other security devices.CVE-2026-42369 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Critical 10
GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other security devices. It is a native application accessed locally, but it is also possible to enable remote access via the "WebCam Server" feature. Once enabled, it is possible to access to the management and monitoring feature via a regular Web interface. This webersever is another native application, compiled without ASLR, which makes exploitation much easier and more likely. Most of the features require authentication before being reachable and leverage a standard login page to grant access. However the `gvapi` endpoint uses its own authentication mechanism via an `HTTP Authorization` header. It supports both `Basic` authentication and the `Digest` modes of authentication. #### Stack-overflow via unbound copy of base64 decoded string The `b64decoder` string is sized dynamically, but it is then copied to the `Buffer` stack variable one character at the time at [0], and there's no bound-check. As such, if the decoded string is bigger than 256 characters (the size of the `Buffer` variable) then a stack overflow occurs. Because the data can be fully controlled by a
- Product
- GV-VMS V20.0.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005.CVE-2026-42469 · Other software · Openvehicles · reported by MITREHigh 8.6
Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_canswitch.cpp the parser does not properly validate a CANswitch DLC value, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted CANswitch frames.
- Product
- Open Vehicle Monitoring System Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 1, 2026Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005.CVE-2026-42468 · Other software · Openvehicles · reported by MITREHigh 8.8
Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_pcap.cpp , the parser's phdr.len field is not properly validated, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted PCAP input.
- Product
- Open Vehicle Monitoring System Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 1, 2026Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005.CVE-2026-37541 · Other software · Openvehicles · reported by MITRECritical 10
Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_gvret.cpp, the length field in GVRET binary data is not properly validated, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted GVRET frames.
- Product
- Open Vehicle Monitoring System Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 21, 2026Vulnerability in Oracle Fusion Middleware (component: Dynamic Monitoring Service).CVE-2026-35232 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4
Vulnerability in Oracle Fusion Middleware (component: Dynamic Monitoring Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Fusion Middleware. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Fusion Middleware, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Fusion Middleware accessible data as well as unauthorized read access to a subset of Oracle Fusion Middleware accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
- Product
- Oracle Fusion Middleware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026Glances is an open-source system cross-platform monitoring tool.CVE-2026-35588 · Other software · nicolargo · reported by GitHubMedium 6.3
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module (`glances/exports/glances_cassandra/__init__.py`) interpolates `keyspace`, `table`, and `replication_factor` configuration values directly into CQL statements without validation. A user with write access to `glances.conf` can redirect all monitoring data to an attacker-controlled Cassandra keyspace. Version 4.5.4 contains a fix.
- Product
- glances
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026Glances is an open-source system cross-platform monitoring tool.CVE-2026-35587 · Other software · nicolargo · reported by GitHubHigh 7.3
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, a Server-Side Request Forgery (SSRF) vulnerability exists in the Glances IP plugin due to improper validation of the public_api configuration parameter. The value of public_api is used directly in outbound HTTP requests without any scheme restriction or hostname/IP validation. An attacker who can modify the Glances configuration can force the application to send requests to arbitrary internal or external endpoints. Additionally, when public_username and public_password are set, Glances automatically includes these credentials in the Authorization: Basic header, resulting in credential leakage to attacker-controlled servers. This vulnerability can be exploited to access internal network services, retrieve sensitive data from cloud metadata endpoints, and/or exfiltrate credentials via outbound HTTP requests. The issue arises because public_api is passed directly to the HTTP client (urlopen_auth) without validation, allowing unrestricted outbound connections and unintended disclosure of sensitive information. Version 4.5.4 contains a patch.
- Product
- glances
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026Glances is an open-source system cross-platform monitoring tool.CVE-2026-34839 · Other software · nicolargo · reported by GitHubHigh 7.7
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (`/api/4/*`) that is accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy (`Access-Control-Allow-Origin: *`). This allows a malicious website to read sensitive system information from a running Glances instance in the victim’s browser, leading to cross-origin data exfiltration. While a previous advisory exists for XML-RPC CORS issues, this report demonstrates that the REST API (`/api/4/*`) is also affected and exposes significantly more sensitive data. Version 4.5.4 patches the issue.
- Product
- glances
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Prometheus is an open-source monitoring system and time series database.CVE-2026-40179 · Other software · prometheus · reported by GitHubMedium 5.3
Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration, data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions 3.5.2 and 3.11.2. If developers are unable to immediat
- Product
- prometheus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026openITCOCKPIT is an open source monitoring tool built for different monitoring engines.CVE-2026-24893 · Other software · openITCOCKPIT · reported by GitHubHigh 8.8
openITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Community Edition prior to version 5.5.2 contains a command injection vulnerability that allows an authenticated user with permission to add or modify hosts to execute arbitrary OS commands on the monitoring backend. The vulnerability arises because user-controlled host attributes (specifically the host address) are expanded into monitoring command templates without validation, escaping, or quoting. These templates are later executed by the monitoring engine (Nagios/Icinga) via a shell, resulting in remote code execution. Version 5.5.2 patches the issue.
- Product
- openITCOCKPIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote code execution via the JMX monitoring port.CVE-2026-6264 · Other software · Talend · reported by 4ac701fe-44e9-4bcd-9585-dd6449257611Critical 9.8
A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote code execution via the JMX monitoring port. The attack vector is the JMX monitoring port of the Talend JobServer. The vulnerability can be mitigated for the Talend JobServer by requiring TLS client authentication for the monitoring port; however, the patch must be applied for full mitigation. For Talend ESB Runtime, the vulnerability can be mitigated by disabling the JobServer JMX monitoring port, which is disabled by default from the R2024-07-RT patch.
- Product
- Talend JobServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026Livestatus injection in the monitoring quicksearch in Checkmk <2.5.0b4 allows an authenticated attacker to inject livestatus commands via the search query due tCVE-2026-33455 · Other software · Checkmk GmbH · reported by security@checkmk.comMedium 5.3
Livestatus injection in the monitoring quicksearch in Checkmk <2.5.0b4 allows an authenticated attacker to inject livestatus commands via the search query due to insufficient input sanitization in search filter plugins.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Beszel is a server monitoring platform.CVE-2026-40077 · Other software · henrygd · reported by GitHubLow 3.5
Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string. This vulnerability is fixed in 0.18.7.
- Product
- beszel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor serCVE-2026-5329 · Other software · Rapid7 · reported by cve@rapid7.comHigh 8.5
Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor server (primarily Linux) that allows an authenticated remote attacker to write to arbitrary internal server queues via a crafted monitoring message with a malicious queue name. The server handler that receives client monitoring messages does not sufficiently validate the queue name supplied by the client, allowing a rogue client to write arbitrary messages to privileged internal queues. This may lead to remote code execution on the Velociraptor server. Rapid7 Hosted Velociraptor instances are not affected by this vulnerability.
- Product
- Velociraptor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026OneUptime is an open-source monitoring and observability platform.CVE-2026-35053 · Other software · OneUptime · reported by GitHubCritical 9.2
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow execution endpoints (GET /workflow/manual/run/:workflowId and POST /workflow/manual/run/:workflowId) without any authentication middleware. An attacker who can obtain or guess a workflow ID can trigger arbitrary workflow execution with attacker-controlled input data, enabling JavaScript code execution, notification abuse, and data manipulation. This issue has been patched in version 10.0.42.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026OneUptime is an open-source monitoring and observability platform.CVE-2026-34840 · Other software · OneUptime · reported by GitHubHigh 8.1
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML SSO implementation (App/FeatureSet/Identity/Utils/SSO.ts) has decoupled signature verification and identity extraction. isSignatureValid() verifies the first <Signature> element in the XML DOM using xml-crypto, while getEmail() always reads from assertion[0] via xml2js. An attacker can prepend an unsigned assertion containing an arbitrary identity before a legitimately signed assertion, resulting in authentication bypass. This issue has been patched in version 10.0.42.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026OneUptime is an open-source monitoring and observability platform.CVE-2026-34759 · Other software · OneUptime · reported by GitHubCritical 9.2
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. These endpoints are externally reachable via the Nginx proxy at /notification/. Combined with a projectId leak from the public Status Page API, an unauthenticated attacker can purchase phone numbers on the victim's Twilio account and delete all existing alerting numbers. This issue has been patched in version 10.0.42.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026OneUptime is an open-source monitoring and observability platform.CVE-2026-34758 · Other software · OneUptime · reported by GitHubCritical 9.1
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints allows SMS/Call/Email/WhatsApp abuse and phone number purchase. This issue has been patched in version 10.0.42.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026An issue was discovered in Percona PMM before 3.7.CVE-2026-25212 · Other software · Percona · reported by MITRECritical 9.9
An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser privileges, an attacker with pmm-admin rights can abuse the "Add data source" feature to break out of the database context and execute shell commands on the underlying operating system.
- Product
- Monitoring And Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.percona.compercona.com
Apr 2, 2026Glances is an open-source system cross-platform monitoring tool.CVE-2026-33641 · Other software · nicolargo · reported by GitHubHigh 7.8
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation. This issue has been patched in version 4.5.3.
- Product
- glances
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Glances is an open-source system cross-platform monitoring tool.CVE-2026-33533 · Other software · nicolargo · reported by GitHubHigh 7.1
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS "simple request" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker's JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses, CPU/memory/disk/network stats, and the full process list including command lines (which often contain tokens, passwords, or internal paths). This issue has been patched in version 4.5.3.
- Product
- glances
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026Alerta is a monitoring tool.CVE-2026-34400 · Other software · alerta · reported by GitHubMedium 6.9
Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.
- Product
- alerta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-32275 · Other software · Tautulli · reported by GitHubHigh 7.4
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before version 2.17.0, an unsanitized JSONP callback parameter allows cross-origin script injection and API key theft. This issue has been patched in version 2.17.0.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-31831 · Other software · Tautulli · reported by GitHubHigh 8.7
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been patched in version 2.17.0.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-31804 · Other software · Tautulli · reported by GitHubMedium 4
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pms_image_proxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme or host. The endpoint is intentionally excluded from all authentication checks in webstart.py, any value of img beginning with http is passed directly to Plex, this causes the Plex Media Server process, which typically runs on the same host or internal network as Tautulli, with access to RFC-1918 address space, to issue an outbound HTTP request to any attacker-specified URL. This issue has been patched in version 2.17.0.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-31799 · Other software · Tautulli · reported by GitHubMedium 4.9
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.17.0 for parameters "before" and "after" and from version 2.1.0-beta to before version 2.17.0 for parameters "section_id" and "user_id", the /api/v2?cmd=get_home_stats endpoint passes the section_id, user_id, before, and after query parameters directly into SQL via Python %-string formatting without parameterization. An attacker who holds the Tautulli admin API key can inject arbitrary SQL and exfiltrate any value from the Tautulli SQLite database via boolean-blind inference. This issue has been patched in version 2.17.0.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-28505 · Other software · Tautulli · reported by GitHubHigh 7.5
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() function in notification_handler.py implements a sandboxed eval() for notification text templates. The sandbox attempts to restrict callable names by inspecting code.co_names of the compiled code object. However, co_names only contains names from the outer code object. When a lambda expression is used, it creates a nested code object whose attribute accesses are stored in code.co_consts, NOT in code.co_names. The sandbox never inspects nested code objects. This issue has been patched in version 2.17.0.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Device Monitoring Studio 8.10.00.8925 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessivelCVE-2019-25655 · Other software · hdd · reported by VulnCheckMedium 6.9
Device Monitoring Studio 8.10.00.8925 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string to the server connection dialog. Attackers can trigger the crash by entering a malformed server name or address containing repeated characters through the Tools menu Connect to New Server interface.
- Product
- Device Monitoring Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Mar 26, 2026OneUptime is an open-source monitoring and observability platform.CVE-2026-33396 · Other software · OneUptime · reported by GitHubCritical 9.9
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged authenticated user (ProjectMember) can achieve remote command execution on the Probe container/host by abusing Synthetic Monitor Playwright script execution. Synthetic monitor code is executed in VMRunner.runCodeInNodeVM with a live Playwright page object in context. The sandbox relies on a denylist of blocked properties/methods, but it is incomplete. Specifically, _browserType and launchServer are not blocked, so attacker code can traverse `page.context().browser()._browserType.launchServer(...)` and spawn arbitrary processes. Version 10.0.35 contains a patch.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026The installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder.CVE-2026-32680 · Other software · RATOC Systems, Inc. · reported by vultures@jpcert.or.jpHigh 8.5
The installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder. If the installation folder is customized to some non-default one, the folder may be left with un-secure ACLs and non-administrative users can alter contents of that folder. It may allow a non-administrative user to execute an arbitrary code with SYSTEM privilege.
- Product
- RATOC RAID Monitoring Manager for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpratocsystems.com
Mar 26, 2026The installer of RATOC RAID Monitoring Manager for Windows searches the current directory to load certain DLLs.CVE-2026-28760 · Other software · RATOC Systems, Inc. · reported by vultures@jpcert.or.jpHigh 8.4
The installer of RATOC RAID Monitoring Manager for Windows searches the current directory to load certain DLLs. If a user is directed to place a crafted DLL with the installer, an arbitrary code may be executed with the administrator privilege.
- Product
- RATOC RAID Monitoring Manager for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpratocsystems.com
Mar 22, 2026A vulnerability was found in Acrel Environmental Monitoring Cloud Platform 1.1.0.CVE-2026-4536 · Other software · Acrel · reported by VulDBMedium 5.5
A vulnerability was found in Acrel Environmental Monitoring Cloud Platform 1.1.0. This issue affects some unknown processing. Performing a manipulation results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Environmental Monitoring Cloud Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-33143 · Other software · OneUptime · reported by GitHubHigh 8.7
OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the WhatsApp POST webhook handler (/notification/whatsapp/webhook) processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature, allowing any unauthenticated attacker to send forged webhook payloads that manipulate notification delivery status records, suppress alerts, and corrupt audit trails. The codebase already implements proper signature verification for Slack webhooks. This issue has been patched in version 10.0.34.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-33142 · Other software · OneUptime · reported by GitHubHigh 8.1
OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the _aggregateBy method but did not apply the same validation to three other query construction paths in StatementGenerator. The toSortStatement, toSelectStatement, and toGroupByStatement methods accept user-controlled object keys from API request bodies and interpolate them as ClickHouse Identifier parameters without verifying they correspond to actual model columns. ClickHouse Identifier parameters are substituted directly into queries without escaping, so an attacker who can reach any analytics list or aggregate endpoint can inject arbitrary SQL through crafted sort, select, or groupBy keys. This issue has been patched in version 10.0.34.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Uptime Kuma is an open source, self-hosted monitoring tool.CVE-2026-33130 · Other software · louislam · reported by GitHubMedium 6.5
Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection (SSTI). The three mitigations added to the Liquid engine (root, relativeReference, dynamicPartials) only block quoted paths. If a project uses an unquoted absolute path, attackers can still read any file on the server. The original fix in notification-provider.js only constrains the first two steps of LiquidJS's file resolution (via root, relativeReference, and dynamicPartials options), but the third step, the require.resolve() fallback in liquid.node.js has no containment check, allowing unquoted absolute paths like /etc/passwd to resolve successfully. Quoted paths happen to be blocked only because the literal quote characters cause require.resolve('"/etc/passwd"') to throw a MODULE_NOT_FOUND error, not because of any intentional security measure. This issue has been fixed in version 2.2.1.
- Product
- uptime-kuma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e.CVE-2026-32771 · Other software · ctfer-io · reported by GitHubHigh 8.8
The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). In versions prior to 0.2.2, the sanitizeArchivePath function in pkg/extract/extract.go (lines 248–254) is vulnerable to Path Traversal due to a missing trailing path separator in the strings.HasPrefix check. The extractor allows arbitrary file writes (e.g., overwriting shell configs, SSH keys, kubeconfig, or crontabs), enabling RCE and persistent backdoors. The attack surface is further amplified by the default ReadWriteMany PVC access mode, which lets any pod in the cluster inject a malicious payload. This issue has been fixed in version 0.2.2.
- Product
- monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.