Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,803 results · page 47 of 277
Apr 8, 2026Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameters.CVE-2025-52221 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameters.
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.CVE-2026-5795 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.4
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
- Product
- Eclipse Jetty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Apr 7, 2026IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default settiCVE-2026-3357 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component.
- Product
- Langflow Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography.CVE-2026-39373 · Other software · latchset · reported by GitHubMedium 5.3
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in 1.5.7.
- Product
- jwcrypto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026There is a memory corruption vulnerability due to an out-of-bounds read in sentry_transaction_context_set_operation() in NI LabVIEW.CVE-2026-32863 · Other software · NI · reported by security@ni.comHigh 8.5
There is a memory corruption vulnerability due to an out-of-bounds read in sentry_transaction_context_set_operation() in NI LabVIEW. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.
- Product
- LabVIEW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settle a large debt position for a negligible asset cost.CVE-2026-4931 · Other software · Marginal · reported by cret@cert.orgHigh 8.6
Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settle a large debt position for a negligible asset cost.
- Product
- Marginal Smart Contract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Kedro-Datasets is a Kendo plugin providing data connectors.CVE-2026-35492 · Other software · kedro-org · reported by GitHubMedium 6.5
Kedro-Datasets is a Kendo plugin providing data connectors. Prior to 9.3.0, PartitionedDataset in kedro-datasets was vulnerable to path traversal. Partition IDs were concatenated directly with the dataset base path without validation. An attacker or malicious input containing .. components in a partition ID could cause files to be written outside the configured dataset directory, potentially overwriting arbitrary files on the filesystem. Users of PartitionedDataset with any storage backend (local filesystem, S3, GCS, etc.) are affected. This vulnerability is fixed in 9.3.0.
- Product
- kedro-plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields has been resolved.CVE-2026-5380 · Other software · runZero · reported by 44488dab-36db-4358-99f9-bc116477f914Medium 5.3
An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields has been resolved. This is an instance of CWE-522: Insufficiently Protected Credentials, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (5.3 Medium). This issue was fixed in version 4.0.260204.2 of the runZero Platform.
- Product
- Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.runzero.comrunzero.com
Apr 7, 2026An issue that allowed MCP agents to access remediation and asset information from outside of the authorized organization scope has been resolved.CVE-2026-5374 · Other software · runZero · reported by 44488dab-36db-4358-99f9-bc116477f914Medium 5.8
An issue that allowed MCP agents to access remediation and asset information from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N (5.8 Medium). This issue was fixed in version 4.0.260202.0 of the runZero Platform.
- Product
- Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.runzero.comrunzero.com
Apr 7, 2026Link Whisper Free: Has a publicly accessible REST endpoint that allows unauthenticated settings updatesCVE-2026-1900 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates.
- Product
- Link Whisper Free
- Fixed in
- 0.9.1
- What to do
- Update Link Whisper Free to 0.9.1 or newer.
Apr 7, 2026In sec boot, there is a possible out of bounds write due to an integer overflow.CVE-2026-20446 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 4.3
In sec boot, there is a possible out of bounds write due to an integer overflow. This could lead to local denial of service, if an attacker has physical access to the device, with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09963054; Issue ID: MSV-3899.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026In Modem, there is a possible out of bounds write due to a missing bounds check.CVE-2026-20433 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comHigh 8.8
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01088681; Issue ID: MSV-4460.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026In Modem, there is a possible out of bounds write due to a missing bounds check.CVE-2026-20432 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comHigh 8
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01406170; Issue ID: MSV-4461.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026In Modem, there is a possible system crash due to a logic error.CVE-2026-20431 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.5
In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01106496; Issue ID: MSV-4467.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSONCVE-2026-34986 · Other software · go-jose · reported by GitHubHigh 7.5
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulner
- Product
- go-jose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory corruption when decoding corrupted satellite data files with invalid signature offsets.CVE-2025-47392 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.8
Memory corruption when decoding corrupted satellite data files with invalid signature offsets.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026GLPI is a free asset and IT management software package.CVE-2026-29047 · Other software · glpi-project · reported by GitHubHigh 7.2
GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the logs export feature. This vulnerability is fixed in 10.0.24 and 11.0.6.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026GLPI is a free asset and IT management software package.CVE-2026-26263 · Other software · glpi-project · reported by GitHubHigh 8.1
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Search engine. This vulnerability is fixed in 11.0.6.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026GLPI is a free asset and IT management software package.CVE-2026-26027 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026GLPI is a free asset and IT management software package.CVE-2026-26026 · Other software · glpi-project · reported by GitHubCritical 9.1
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026GLPI is a Free Asset and IT Management Software package.CVE-2026-25932 · Other software · glpi-project · reported by GitHubHigh 7.2
GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset conn->binding on failed binding request When a multichannel SMB2_SESSION_SETUCVE-2026-31409 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.8
In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset conn->binding on failed binding request When a multichannel SMB2_SESSION_SETUP request with SMB2_SESSION_REQ_FLAG_BINDING fails ksmbd sets conn->binding = true but never clears it on the error path. This leaves the connection in a binding state where all subsequent ksmbd_session_lookup_all() calls fall back to the global sessions table. This fix it by clearing conn->binding = false in the error path.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 4, 2026Termite 3.4 contains a buffer overflow vulnerability in the User interface language settings field that allows local attackers to cause a denial of service by sCVE-2018-25253 · Other software · Compuphase · reported by VulnCheckMedium 6.9
Termite 3.4 contains a buffer overflow vulnerability in the User interface language settings field that allows local attackers to cause a denial of service by supplying an excessively long string. Attackers can paste a 2000-byte payload into the Settings User interface language field to crash the application.
- Product
- Termite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcompuphase.comcompuphase.com
Apr 3, 2026In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix deadlock in soft reset sequence The soft reset sequence is currently CVE-2026-23470 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix deadlock in soft reset sequence The soft reset sequence is currently executed from the threaded IRQ handler, hence it cannot call disable_irq() which internally waits for IRQ handlers, i.e. itself, to complete. Use disable_irq_nosync() during a soft reset instead.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 3, 2026In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check cdc_ncm_rx_verify_ndp16() vCVE-2026-23448 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check cdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE entries fit within the skb. The first check correctly accounts for ndpoffset: if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) > skb_in->len) but the second check omits it: if ((sizeof(struct usb_cdc_ncm_ndp16) + ret * (sizeof(struct usb_cdc_ncm_dpe16))) > skb_in->len) This validates the DPE array size against the total skb length as if the NDP were at offset 0, rather than at ndpoffset. When the NDP is placed near the end of the NTB (large wNdpIndex), the DPE entries can extend past the skb data buffer even though the check passes. cdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating the DPE array. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 3, 2026In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug fCVE-2026-23447 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly. Compile-tested only.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 3, 2026In the Linux kernel, the following vulnerability has been resolved: perf/x86: Move event pointer setup earlier in x86_pmu_enable() A production AMD EPYC systeCVE-2026-23435 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: perf/x86: Move event pointer setup earlier in x86_pmu_enable() A production AMD EPYC system crashed with a NULL pointer dereference in the PMU NMI handler: BUG: kernel NULL pointer dereference, address: 0000000000000198 RIP: x86_perf_event_update+0xc/0xa0 Call Trace: <NMI> amd_pmu_v2_handle_irq+0x1a6/0x390 perf_event_nmi_handler+0x24/0x40 The faulting instruction is `cmpq $0x0, 0x198(%rdi)` with RDI=0, corresponding to the `if (unlikely(!hwc->event_base))` check in x86_perf_event_update() where hwc = &event->hw and event is NULL. drgn inspection of the vmcore on CPU 106 showed a mismatch between cpuc->active_mask and cpuc->events[]: active_mask: 0x1e (bits 1, 2, 3, 4) events[1]: 0xff1100136cbd4f38 (valid) events[2]: 0x0 (NULL, but active_mask bit 2 set) events[3]: 0xff1100076fd2cf38 (valid) events[4]: 0xff1100079e990a90 (valid) The event that should occupy events[2] was found in event_list[2] with hw.idx=2 and hw.state=0x0, confirming x86_pmu_start() had run (which clears hw.state and sets active_mask) but events[2] was never populated. Another event (even
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 3, 2026In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked CVE-2026-35536 · Other software · tornadoweb · reported by MITREHigh 7.2
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
- Product
- Tornado
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal errCVE-2026-35535 · Other software · Sudo project · reported by MITREHigh 7.4
In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
- Product
- Sudo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgbugs.launchpad.net
Apr 2, 2026Shynet before 0.14.0 allows Host header injection in the password reset flow.CVE-2026-35507 · Other software · milesmcc · reported by MITREMedium 6.4
Shynet before 0.14.0 allows Host header injection in the password reset flow.
- Product
- Shynet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performeCVE-2026-35385 · Other software · OpenBSD · reported by MITREHigh 7.5
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.CVE-2026-26895 · Other software · Enhancesoft · reported by MITREMedium 5.3
User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls.CVE-2026-33691 · Other software · coreruleset · reported by GitHubMedium 6.8
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.
- Product
- coreruleset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special CVE-2026-33615 · Other software · MB connect line · reported by info@cert.vde.comCritical 9.1
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elements in a SQL UPDATE command. This can result in a total loss of integrity and availability.
- Product
- mbCONNECT24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.commbconnectline.csaf-tp.certvde.com
Apr 2, 2026SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by abusing GINA account initialization to reset a victim account password.CVE-2026-29139 · Other software · SEPPmail · reported by vulnerability@ncsc.chHigh 7.8
SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by abusing GINA account initialization to reset a victim account password.
- Product
- Secure Email Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloads.seppmail.com
Apr 1, 2026V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default.CVE-2026-32927 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information disclosure from the affected product.
- Product
- V-SFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfelib.fujielectric.co.jpjvn.jp
Apr 1, 2026IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user onCVE-2025-66483 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.
- Product
- Aspera Shares
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies.CVE-2026-4820 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
- Product
- Maximo Application Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster.CVE-2026-5199 · Other software · Temporal Technologies, Inc. · reported by security@temporal.ioLow 2.3
A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster. Exploitation requires the attacker to know or guess specific victim workflow ID(s) and, for signal operations, signal names. This was due to a bug introduced in Temporal Server v1.29.0 which inadvertently allowed an attacker to control the namespace name value instead of using the server's own trusted name value within the batch activity code. The batch activity validated the namespace ID but did not cross-check the namespace name against the worker's bound namespace, allowing the per-namespace worker's privileged credentials to operate on an arbitrary namespace. Exploitation requires a server configuration where internal components have cross-namespace authorization, such as deployment of the internal-frontend service or equivalent TLS-based authorization for internal identities. This vulnerability also impacted Temporal Cloud when the attacker and victim namespaces were on the same cell, with the same preconditions as self-hosted clusters.
- Product
- temporal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.CVE-2026-30643 · Other software · Dedecms · reported by MITRECritical 9.8
An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comdedecms.com
Apr 1, 2026TOTOlink A3600R v5.9c.4959 contains a buffer overflow vulnerability in the setAppEasyWizardConfig interface of /lib/cste_modules/app.so.CVE-2026-31027 · Other software · Totolink · reported by MITRECritical 9.8
TOTOlink A3600R v5.9c.4959 contains a buffer overflow vulnerability in the setAppEasyWizardConfig interface of /lib/cste_modules/app.so. The vulnerability occurs because the rootSsid parameter is not properly validated for length, allowing remote attackers to trigger a buffer overflow, potentially leading to arbitrary code execution or denial of service.
- Product
- A3600r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5.0b2 and 2.4.0 before version 2.4.0p25 aCVE-2026-24096 · Other software · Checkmk GmbH · reported by security@checkmk.comMedium 5.3
Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5.0b2 and 2.4.0 before version 2.4.0p25 allows low-privileged users to perform unauthorized actions or obtain sensitive information
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026In the Linux kernel, the following vulnerability has been resolved: apparmor: fix memory leak in verify_header The function sets `*ns = NULL` on every call, lCVE-2026-23403 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix memory leak in verify_header The function sets `*ns = NULL` on every call, leaking the namespace string allocated in previous iterations when multiple profiles are unpacked. This also breaks namespace consistency checking since *ns is always NULL when the comparison is made. Remove the incorrect assignment. The caller (aa_unpack) initializes *ns to NULL once before the loop, which is sufficient.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 31, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-34556 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.2
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a heap-buffer-overflow (HBO) in icAnsiToUtf8() in the XML conversion path. The issue is triggered by a crafted ICC profile which causes icAnsiToUtf8(std::string&, char const*) to treat an input buffer as a C-string and call operations that rely on strlen()/null-termination. AddressSanitizer reports an out-of-bounds READ of size 115 past a 114-byte heap allocation, with the failure observed while running the iccToXml tool. This issue has been patched in version 2.3.1.6.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-34555 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.2
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a stack-buffer-overflow (SBO) in CIccTagFixedNum<>::GetValues() and a related bug chain. The primary crash is an AddressSanitizer-reported WRITE of size 4 that overflows a 4-byte stack variable (rv) via the call chain CIccTagFixedNum::GetValues() -> CIccTagStruct::GetElemNumberValue(). This issue has been patched in version 2.3.1.6.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-34554 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.2
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a heap-buffer-overflow (HBO) in CIccApplyCmmSearch::costFunc() can be triggered via malformed JSON configuration input to the iccApplySearch tool. AddressSanitizer reports an out-of-bounds READ of size 8 originating from CIccApplyCmmSearch::costFunc(CIccSearchVec&) at IccProfLib/IccCmmSearch.cpp:112:5. This issue has been patched in version 2.3.1.6.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-34553 · Other software · InternationalColorConsortium · reported by GitHubMedium 4
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a defect in LUT dump/iteration logic affecting CIccCLUT::Iterate() and output produced by CIccMBB::Describe() (via CLUT dumping). This issue has been patched in version 2.3.1.6.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-34552 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.2
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is an Undefined Behavior (UB) issue in IccTagLut.cpp where the code performs member access through a null pointer of type CIccApplyCLUT. This issue has been patched in version 2.3.1.6.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-34551 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.2
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a null-pointer dereference (NPD) in CIccTagLut16::Write() can be triggered when processing a crafted ICC profile (embedded in a TIFF and extracted during iccTiffDump). This issue has been patched in version 2.3.1.6.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026iccDEV provides a set of libraries and tools for working with ICC color management profiles.CVE-2026-34550 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.2
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is an Undefined Behavior (UB) condition in IccProfLib/IccIO.cpp caused by an implicit conversion from a negative signed integer to size_t (unsigned), which changes the value. This issue has been patched in version 2.3.1.6.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.