Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,286 results · page 45 of 346
Aug 4, 2026Ghost is a Node.js content management system.CVE-2026-70591 · Other software · TryGhost · reported by GitHubMedium 4.1
Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. This issue is fixed in version 6.54.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026Ghost is a Node.js content management system.CVE-2026-70590 · Other software · TryGhost · reported by GitHubMedium 4.8
Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. This issue is fixed in version 6.54.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026Ghost is a Node.js content management system.CVE-2026-70589 · Other software · TryGhost · reported by GitHubMedium 4.8
Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled.CVE-2026-67855 · Other software · reported by MITREHigh 7.5
open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. This allows a remote attacker to cause a denial of service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role NCVE-2026-51144 · Other software · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026Ghost is a Node.js content management system.CVE-2026-70588 · Other software · TryGhost · reported by GitHubMedium 5
Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution.CVE-2026-58072 · Other software · Veeam · reported by support@hackerone.comCritical 9
A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution.
- Product
- Service Provider Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important CliCVE-2026-18806 · Other software · TÜBİTAK BİLGEM Software Technologies Research Institute · reported by iletisim@usom.gov.trHigh 7.1
External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 0.9.0.
- Product
- pardus-image-writer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026Wired Impact Volunteer Management: Does not have authorisation checks in one of its AJAX actionsCVE-2026-16546 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from any volunteer opportunity.
- Product
- Wired Impact Volunteer Management
- Fixed in
- 2.8.2
- What to do
- Update Wired Impact Volunteer Management to 2.8.2 or newer.
Aug 4, 2026Easy Integration for Dropbox: Does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated usersCVE-2026-15958 · WordPress plugins & themes · reported by WPScanCritical 9.3
The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.
- Product
- Easy Integration for Dropbox
- Fixed in
- 2.2.0
- What to do
- Update Easy Integration for Dropbox to 2.2.0 or newer.
Aug 4, 2026A flaw was found in popt, a command-line option parsing library.CVE-2026-18739 · Other software · rpm-software-management · reported by Red HatLow 2.5
A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
- Product
- popt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 3, 2026The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in response_json_CVE-2026-10849 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgHigh 8.2
The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in response_json_cb() (subsys/mgmt/hawkbit/hawkbit.c). The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When the full response has arrived, the code writes response_data[downloaded_size] = '\0' — and whenever the accumulated body length equals the allocation, that terminator lands one byte past the end of the heap object (a heap-based out-of-bounds write, CWE-122 / CWE-787). The body length and fragmentation are taken directly from the parsed HTTP response (rsp->body_frag_start / rsp->body_frag_len) and are fully controlled by the remote hawkBit server, which chooses its own response length. The precise trigger depends on how the buffer grows, and both forms are remotely reachable. Since v4.0.0 the reallocation is sized to exactly downloaded_size + body_len, so any response body larger than the 1100-byte initial buffer makes the out-of-bounds write deterministic; such response sizes are normal for hawkBit deployment metadata. Before v4.0.0 the buffer grew by doubling and the growth check ((dow
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to injeCVE-2026-49131 · Other software · Deciso B.V. · reported by VulnCheckMedium 5.1
OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript by embedding payloads in the firewall rule description field via the filter API endpoint. The unsanitized description value is persisted and later rendered through the default cell formatter in opnsense_bootgrid.js, which assigns raw cell content to innerHTML, causing injected scripts to execute in the browser of any authenticated user who views the Firewall Rules page, enabling session hijacking or credential theft.
- Product
- OPNsense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opnsense.orggithub.com
Aug 3, 2026A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13.CVE-2026-18641 · Other software · Sangfor · reported by VulDBMedium 5.5
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portal_login of the component Login Endpoint. This manipulation causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Operation and Maintenance Security Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourcCVE-2026-69089 · Other software · getgrav · reported by VulnCheckHigh 8.7
Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses '..' segments without a realpath/containment check, an editor authoring Markdown image syntax with traversal sequences can cause arbitrary image files outside Grav's media sandbox to be composited into a carrier image, which is then cached and served from a public, unauthenticated URL — disclosing those files to anonymous visitors.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection.CVE-2026-18642 · Other software · TUBITAK BILGEM Software Technologies Research Institute · reported by iletisim@usom.gov.trHigh 7.8
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4.
- Product
- eta-otp-lock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticateCVE-2026-18574 · Other software · checkpoint · reported by cve@checkpoint.comCritical 9.3
An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system. Check Point discovered this issue internally and has no indication of active exploitation.
- Product
- Security Management Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.checkpoint.com
Aug 2, 2026Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown.CVE-2026-10774 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgLow 2.4
Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_keys_create() imports the Private Beacon Key into a PSA key slot under CONFIG_BT_MESH_PRIV_BEACONS (enabled by default), but subnet_keys_destroy() guarded the matching psa_destroy_key() with CONFIG_BT_MESH_V1d1. That Kconfig symbol was removed when explicit Mesh 1.0.1 support was dropped, so the destroy branch became permanently dead code and the import is never balanced by a destroy. The imbalanced teardown is reached every time subnet keys are destroyed: deleting a subnet (Config Server NetKey Delete), completing a Key Refresh Procedure (which retires the old key set), and resetting/re-provisioning the node. The over-the-air triggers are processed only under the node's device key, so they are exercisable by the provisioner or network administrator that owns the node, reachable over the Bluetooth Mesh network. With the default CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT of 16, repeated add/delete or key-refresh cycles exhaust the shared PSA key-slot pool after roughly a dozen rounds. Once exhausted, bt_mesh_private_beacon_key() and thus subnet cr
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management.CVE-2026-68581 · Other software · go-vikunja · reported by VulnCheckHigh 8.6
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a link-share JWT whose numeric ID equals a target user's ID is treated as that user by the /api/v1/tokens endpoints. An authenticated attacker can obtain a target's numeric user ID via authenticated user search, then create link shares on an attacker-writable project until the link-share sequence reaches that value, and use the resulting link-share JWT to list, create, and delete the target user's API tokens (including issuing a new token with attacker-chosen scopes under the target's permissions). Fixed in version 2.4.0.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2026Event Tickets and Registration: Does not perform any authorization check on one of its order-management REST endpointsCVE-2026-14822 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.
- Product
- Event Tickets and Registration
- Fixed in
- 5.29.0.1
- What to do
- Update Event Tickets and Registration to 5.29.0.1 or newer.
Jul 31, 2026gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI.CVE-2026-54785 · Other software · eLyiN · reported by GitHubMedium 6.2
gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1.
- Product
- gemini-bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler componentsCVE-2026-51953 · Other software · reported by MITREHigh 7.4
An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026REDAXO is a PHP-based content management system.CVE-2026-53599 · Other software · redaxo · reported by GitHubHigh 7.5
REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.CVE-2026-52856 · Other software · pterodactyl · reported by GitHubHigh 7.5
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.
- Product
- wings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.CVE-2026-52855 · Other software · pterodactyl · reported by GitHubCritical 9.9
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.
- Product
- wings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.CVE-2026-52857 · Other software · pterodactyl · reported by GitHubMedium 5.5
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is fixed in version 1.13.0.
- Product
- wings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026A flaw was found in the TokenManager component of the Keycloak identity management service.CVE-2026-18218 · Other software · Red Hat · reported by Red HatMedium 4.2
A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 31, 2026A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution.CVE-2026-18217 · Other software · Red Hat · reported by Red HatLow 3.4
A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker's parameters. This can cause some service providers to process the attacker's data instead of the real login information, potentially leading to a user being logged into the wrong account.
- Product
- Red Hat build of Keycloak 26.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 31, 2026A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services.CVE-2026-18206 · Other software · Red Hat · reported by Red HatLow 3.7
A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update clients. Due to improper validation, the system accepts any hostname that ends with the specified domain suffix, even if it is not a legitimate subdomain. An attacker who can control the reverse DNS of their connection can bypass these host-based restrictions, potentially allowing unauthorized client modifications.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 31, 2026A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution.CVE-2026-18203 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs to a different group with a similar starting name to bypass security checks and gain unauthorized access to administrative functions or protected resources.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 31, 2026Cloudreve is a self-hosted file management and sharing system.CVE-2026-62323 · Other software · cloudreve · reported by GitHubMedium 6.3
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token suffix and invoke WOPI write routes for the underlying file. This issue is fixed in version 4.17.0.
- Product
- cloudreve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026Cloudreve is a self-hosted file management and sharing system.CVE-2026-55502 · Other software · cloudreve · reported by GitHubHigh 7.1
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and app_id values, allowing an OAuth token without Admin.Write to modify storage policy credentials. The route is inside the admin group that requires Admin.Read, but it does not add the local Admin.Write guard used by sibling policy mutation routes. Its handler persists attacker-supplied secret and app_id values into the selected OneDrive storage policy before returning an OAuth URL. This issue is fixed in version 4.17.0.
- Product
- cloudreve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026Cloudreve is a self-hosted file management and sharing system.CVE-2026-55499 · Other software · cloudreve · reported by GitHubMedium 4.3
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets, event types, and hashed identifiers for unshared sibling files and folders. This issue is fixed in version 4.17.0.
- Product
- cloudreve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026Cloudreve is a self-hosted file management and sharing system.CVE-2026-55497 · Other software · cloudreve · reported by GitHubMedium 6.5
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but do not limit decoded pixel dimensions, allowing an authenticated user to submit a small PNG, JPEG, or GIF that triggers an unbounded allocation and terminates the Cloudreve process through fatal out-of-memory behavior. This issue is fixed in version 4.17.0.
- Product
- cloudreve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026Cloudreve is a self-hosted file management and sharing system.CVE-2026-55496 · Other software · cloudreve · reported by GitHubMedium 4.3
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addresses and profile metadata for inactive or banned accounts. The service calls userClient.SearchActive, but despite its name that method filters only by email/nickname keyword and never adds a StatusActive predicate — while the sibling lookups GetActiveByID and GetActiveByDavAccount, defined a few lines above it, do. Search hits are serialized at RedactLevelUser, which includes the email address. This issue is fixed in version 4.17.0.
- Product
- cloudreve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026Cloudreve is a self-hosted file management and sharing system.CVE-2026-55495 · Other software · cloudreve · reported by GitHubMedium 4.3
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite files elsewhere in the same owner account. This issue is fixed in version 4.17.0.
- Product
- cloudreve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.CVE-2025-69938 · Other software · reported by MITRECritical 9.8
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.CVE-2025-69937 · Other software · reported by MITRECritical 9.8
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.CVE-2025-69936 · Other software · reported by MITRECritical 9.8
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.CVE-2025-69935 · Other software · reported by MITRECritical 9.8
CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.CVE-2025-69934 · Other software · reported by MITRECritical 9.8
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.CVE-2025-69933 · Other software · reported by MITRECritical 9.8
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.CVE-2025-69931 · Other software · reported by MITRECritical 9.8
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.CVE-2025-69930 · Other software · reported by MITRECritical 9.8
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026OpenProject is open-source, web-based project management software.CVE-2026-67529 · Other software · opf · reported by GitHubMedium 4.3
OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPackage.title and _links.workPackage.href through associated_resource in modules/costs/lib/api/v3/time_entries/time_entry_representer.rb and modules/costs/lib/api/v3/cost_entries/cost_entry_representer.rb without checking WorkPackage.visible or view_work_packages, allowing users with view_time_entries or view_cost_entries to read private work package subjects and ids. This issue is fixed in 17.6.0.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026OpenProject is open-source, web-based project management software.CVE-2026-67528 · Other software · opf · reported by GitHubMedium 4.3
OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options without checking visible(current_user), so authenticated non-admin users could enumerate sequential custom option ids and read labels belonging to admin_only user or group custom fields. This issue is fixed in 17.6.0.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026OpenProject is open-source, web-based project management software.CVE-2026-67527 · Other software · opf · reported by GitHubHigh 7.6
OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and allowed authenticated users with edit_work_packages but without manage_file_links to resolve Storages::FileLink records by raw id, detach or hard-delete existing FileLinks, and re-parent FileLinks from other projects to an attacker-controlled work package, exposing origin filename, origin id, and MIME type metadata. This issue is fixed in 17.6.0.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability.CVE-2026-14227 · Network & remote access · MikroTik · reported by ics-cert@hq.dhs.govMedium 6.9
An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could alloCVE-2026-12943 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
- Product
- HMC V10.3.1050.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting.CVE-2025-0152 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- Engineering Requirements Management DOORS and DOORS Web Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.