Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
394,547 results · page 407 of 7891
Sep 30, 2026Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery.CVE-2026-102095 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.1
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cloud instance metadata endpoints and return the responses, potentially disclosing sensitive internal data and, depending on the internal service reached, affecting its state.
- Product
- Email Protection Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing CVE-2026-102094 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.2
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cause the gateway to load and execute code beyond the approved set of mail-processing components, potentially in the context of the mail-gateway service account.
- Product
- Email Protection Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could aCVE-2026-102093 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.2
Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that execCVE-2026-102092 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.7
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the sCVE-2026-102091 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.5
Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only services or other network-restricted resources.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Core before version 9.5.1 is vulnerable to Content Injection.CVE-2026-102090 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.3
Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relying on malicious links embedded in the displayed content.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticatedCVE-2026-102089 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.2
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the underlying system.
- Product
- Email Protection Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without canceCVE-2026-101276 · Other software · esnet · reported by 98a01053-8a31-4f6d-9aa9-252be161adc6Critical 9.2
iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22.
- Product
- iperf3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated remote attackeCVE-2024-58387 · Other software · Inspur · reported by VulnCheckHigh 8.7
Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as /api/model_report/file/download?index=/&ext=<path> to traverse the filesystem and disclose sensitive files including /etc/passwd, application database files, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-04 .
- Product
- Haiyue HCM Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass autheCVE-2023-54403 · Other software · Yonyou · reported by VulnCheckHigh 8.7
Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this flaw to read sensitive files outside the web application directory, including configuration files containing database or service credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
- Product
- U8 CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs bCVE-2023-54402 · Other software · iDocView · reported by VulnCheckHigh 8.7
iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value (testtoken) to bypass authentication. Attackers can exploit the unrestricted URL scheme handling, including file:// URIs, to read arbitrary local files such as operating-system and application configuration files, and to reach internal network hosts and services not otherwise accessible. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-26.
- Product
- iDocView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netgithub.com
Sep 30, 2026Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90CVE-2026-103548 · Other software · Itron · reported by psirt@paloaltonetworks.comMedium 5.3
Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.
- Product
- MV-90 xi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client fCVE-2026-103547 · Other software · OpenBSD · reported by MITRECritical 9.2
In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can receive the earlier authentication result. A remote attacker who can reach ldapd can complete a Bind as another identity. A missing connection can also cause a NULL pointer dereference. (ldapd is not enabled by default.)
- Product
- OpenBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.openbsd.orggithub.com
Sep 30, 2026A weakness has been identified in garycourt uri-js up to 4.4.1.CVE-2026-103387 · Other software · garycourt · reported by VulDBLow 2.1
A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- uri-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-102994 · Other software · py-pdf · reported by GitHubHigh 8.7
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypdf/generic/_base.py to scan excessive input through read_until_whitespace, resulting in long runtimes and application unavailability. This issue is fixed in version 6.18.0.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-102993 · Other software · py-pdf · reported by GitHubHigh 8.7
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026piscina is a node.js worker pool implementation.CVE-2026-102992 · Other software · piscinajs · reported by GitHubCritical 9.2
piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5.
- Product
- piscina
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Mako is a template library written in Python.CVE-2026-102991 · Other software · sqlalchemy · reported by GitHubMedium 6.5
Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Template.__init__() in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpath to absorb the traversal segments before the leading dot-dot check, while posixpath resolution can escape the configured template directory. An application that passes attacker-controlled template names or include paths can disclose process-readable files on the same volume, and a targeted file containing Mako template syntax may also be parsed and executed as a template. Raw URL paths are generally normalized before reaching this form, but query strings, form or JSON bodies, route parameters, and dynamic include expressions can preserve it. This issue is fixed in version 1.4.2.
- Product
- mako
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026basic-ftp is an FTP client for Node.js.CVE-2026-102990 · Other software · patrickjuchli · reported by GitHubHigh 8.2
basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.
- Product
- basic-ftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_patCVE-2026-101885 · Other software · zeroclaw-labs · reported by VulnCheckHigh 8.5
ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins directory, such as shell startup files, enabling code execution.
- Product
- ZeroClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOKSCVE-2026-101884 · Other software · OpenClaw · reported by VulnCheckHigh 7.7
OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA_TOOL_OPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or java to load attacker-controlled code and achieve arbitrary code execution.
- Product
- OpenClaw Windows Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation eCVE-2026-101883 · Other software · OpenClaw · reported by VulnCheckMedium 5.3
OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to localhost, private networks, or tailnet services from the user's machine.
- Product
- OpenClaw Windows Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abuCVE-2026-101882 · Other software · OpenClaw · reported by VulnCheckHigh 8.7
OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the Windows host through system.run without operator checks or user prompts.
- Product
- OpenClaw Windows Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected CVE-2026-101881 · Other software · OpenClaw · reported by VulnCheckHigh 7.1
OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause unbounded memory growth until the node process crashes.
- Product
- OpenClaw Windows Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser failCVE-2026-101880 · Other software · OpenClaw · reported by VulnCheckHigh 8.7
OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing denied commands behind allowed prefixes using pipe operators or command substitution syntax, achieving arbitrary command execution on Windows hosts.
- Product
- OpenClaw Windows Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents CVE-2026-101879 · Other software · OpenClaw · reported by VulnCheckHigh 7.1
OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot, camera.snap, and location.get over the node WebSocket to silently capture screenshots, photograph users through webcams, and obtain device geolocation without user interaction.
- Product
- OpenClaw Windows Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.CVE-2026-97291 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.
- Affected
- up to 1.66
- What to do
- Affects up to 1.66. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.CVE-2026-97290 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.
- Affected
- up to 3.36
- What to do
- Affects up to 3.36. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97265 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.
- Product
- JetEngine
- Affected
- up to 3.8.15.3
- What to do
- Affects up to 3.8.15.3. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.CVE-2026-97256 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
- Affected
- up to 2.36.0
- What to do
- Affects up to 2.36.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026VillaTheme CURCY woo-multi-currency: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94171 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18.
- Product
- VillaTheme CURCY woo-multi-currency
- What to do
- Update VillaTheme CURCY woo-multi-currency to the newest version.
Sep 30, 2026Tugtainer is a self-hosted app for automating updates of Docker containers.CVE-2026-87004 · Other software · Quenary · reported by GitHubHigh 8.1
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/auth_oidc_provider.py decodes the id_token returned by the identity provider's token endpoint using jose.jwt.get_unverified_claims() instead of jwt.decode(). This skips signature verification, audience (aud) validation, issuer (iss) validation, and expiry (exp) checking entirely. The extracted claims (email/sub/preferred_username) are then used directly as the user_id for the resulting Tugtainer session. This issue has been patched in version 1.31.3.
- Product
- tugtainer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal managemeCVE-2026-55224 · Other software · mineadmin · reported by GitHubHigh 8.7
MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences (e.g., ../) to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands. This issue has been patched in version 3.2.0-alpha.2.
- Product
- MineAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user fCVE-2026-55107 · Other software · elct9620 · reported by GitHubCritical 10
Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-process without giving them access to host memory, files, network, or credentials. From version 0.1.0 to before version 0.9.1, a guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. This issue has been patched in version 0.9.1.
- Product
- kobako
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes.CVE-2026-55094 · Other software · taskcluster · reported by GitHubHigh 8.7
Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0.
- Product
- taskcluster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orggithub.com
Sep 30, 2026Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen.CVE-2026-53605 · Other software · pollen-robotics · reported by GitHubHigh 7.8
Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4, the Reachy Mini Wireless OS image shipped with an overly broad sudoers entry granting the pollen daemon user (uid 1000) passwordless sudo access to /usr/bin/systemctl with no subcommand or argument restriction. This is a local privilege escalation (LPE). Any process running as pollen can obtain full root (uid 0) on the device in three commands, with no additional vulnerability required and no user interaction. This issue has been patched in version 0.2.4.
- Product
- reachy-mini-os
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size.CVE-2026-103500 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 30, 2026yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download CVE-2026-103476 · Other software · yii2-starter-kit · reported by VulnCheckMedium 6.9
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without authentication or authorization checks.
- Product
- yii2-starter-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configurationCVE-2026-103475 · Other software · yii2-starter-kit · reported by VulnCheckCritical 9.3
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.
- Product
- yii2-starter-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files.CVE-2026-103474 · Other software · yii2-starter-kit · reported by VulnCheckHigh 8.7
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.
- Product
- yii2-starter-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong sheCVE-2026-103473 · Other software · denoland · reported by VulnCheckCritical 9.2
Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with Deno process privileges.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded streamCVE-2026-103472 · Other software · Corvusoft · reported by VulnCheckHigh 8.7
restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through process crash.
- Product
- restbed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory.CVE-2026-103471 · Other software · Corvusoft · reported by VulnCheckHigh 8.7
restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate unbounded heap memory until the process is killed.
- Product
- restbed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.CVE-2026-103446 · Other software · The Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccHigh 7.4
Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.
- Product
- MediaWiki WikiLambda extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Sep 30, 2026Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows StCVE-2026-103445 · Other software · The Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccLow 1.2
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS. This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1.43.
- Product
- MediaWiki Page_Forms extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Sep 30, 2026Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation.CVE-2026-103440 · Other software · The Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccLow 1.2
Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.
- Product
- MediaWiki PageTriage extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Sep 30, 2026Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows CrossCVE-2026-103439 · Other software · The Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccLow 0.3
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikbase extension: 1.46, 1.45, and 1.43.
- Product
- MediaWiki Wikbase extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Sep 30, 2026Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows CCVE-2026-103438 · Other software · The Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccLow 0.3
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.
- Product
- MediaWiki Wikistories extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Sep 30, 2026Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows CVE-2026-103437 · Other software · The Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccLow 1.1
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.
- Product
- MediaWiki ReadingLists extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Sep 30, 2026A flaw was found in SoupServer (libsoup).CVE-2026-103399 · Other software · Red Hat · reported by Red HatMedium 5.3
A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.