Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8,110 results · page 49 of 163
Apr 13, 2026During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages.CVE-2026-34264 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low privileges could guess and enumerate the content shown, beyond their authorized scope. This leads to disclosure of sensitive information causing a high impact on confidentiality, while integrity and availability are unaffected.
- Product
- SAP Human Capital Management for SAP S/4HANA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address.CVE-2026-31283 · Other software · reported by MITRECritical 9.8
In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. which can be used for an Email Bombing attack. NOTE: the Supplier's position is that the pwresettime configuration defaults to 30 minutes, the pwresettime configuration is a hard control enforced via flag PWRESET_STATUS_ALREADYSENT, and no further password-reset email messages are sent if this flag is active for a specific email address.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations.CVE-2026-5936 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 8.5
An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment.
- Product
- Foxit PDF Services API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2026A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarmaCVE-2026-31845 · Other software · Rukovoditel · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.3
A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions.
- Product
- Rukovoditel CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation.CVE-2026-40180 · Other software · quarkiverse · reported by GitHubHigh 7.7
Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip() method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is constructed as new File(toOutputDir, entry.getName()) and the content is written immediately. A malicious ZIP archive containing entries with path traversal sequences (e.g., ../../malicious.java) would write files outside the target directory. This vulnerability is fixed in 2.16.0 and 2.15.0-lts.
- Product
- quarkus-openapi-generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.CVE-2026-32252 · Other software · chartbrew · reported by GitHubHigh 7.7
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cross-tenant authorization bypass exists in Chartbrew in GET /team/:team_id/template/generate/:project_id. The GET handler calls checkAccess(req, "updateAny", "chart") without awaiting the returned promise, and it does not verify that the supplied project_id belongs to req.params.team_id or to the caller's team. As a result, an authenticated attacker with valid template-generation permissions in their own team can request the template model for a project belonging to another team and receive victim project data. This vulnerability is fixed in 4.9.0.
- Product
- chartbrew
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.CVE-2026-30232 · Other software · chartbrew · reported by GitHubHigh 7.8
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew allows authenticated users to create API data connections with arbitrary URLs. The server fetches these URLs using request-promise without any IP address validation, enabling Server-Side Request Forgery attacks against internal networks and cloud metadata endpoints. This vulnerability is fixed in 4.8.5.
- Product
- chartbrew
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2026-40074 · Other software · sveltejs · reported by GitHubMedium 6.3
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2026-40073 · Other software · sveltejs · reported by GitHubHigh 8.2
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.CVE-2026-40227 · Other software · systemd · reported by MITREMedium 6.2
In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.
- Product
- systemd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause aCVE-2026-5774 · Other software · Canonical · reported by security@ubuntu.comMedium 6
Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remote attackers to write arbitrary files andCVE-2026-6057 · Other software · FalkorDB · reported by 33c584b5-0579-4c06-b2a0-8d8329fcab9cCritical 9.8
FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remote attackers to write arbitrary files and achieve remote code execution.
- Product
- FalkorDB Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026The installer certificate files in the …/bootstrap/common/ssl folder do not seem to have restricted permissions on Windows systems (users have read and execute CVE-2026-4482 · Other software · Rapid7 · reported by cve@rapid7.comMedium 6.8
The installer certificate files in the …/bootstrap/common/ssl folder do not seem to have restricted permissions on Windows systems (users have read and execute access). For the client.key file in particular, this could potentially lead to exploits, as this exposes agent identity material to any locally authenticated standard user.
- Product
- Insight Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026OpenPLC_V3 REST API endpoint checks for JWT presence but never verifies the caller's role.CVE-2026-35063 · Other software · OpenPLC_V3 · reported by ics-cert@hq.dhs.govHigh 8.7
OpenPLC_V3 REST API endpoint checks for JWT presence but never verifies the caller's role. Any authenticated user with role=user can delete any other user, including administrators, by specifying their user ID or they can create new accounts with role=admin, escalating to full administrator access.
- Product
- OpenPLC_V3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.CVE-2026-34483 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.
- Product
- Apache Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Apr 9, 2026Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor serCVE-2026-5329 · Other software · Rapid7 · reported by cve@rapid7.comHigh 8.5
Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor server (primarily Linux) that allows an authenticated remote attacker to write to arbitrary internal server queues via a crafted monitoring message with a malicious queue name. The server handler that receives client monitoring messages does not sufficiently validate the queue name supplied by the client, allowing a rogue client to write arbitrary messages to privileged internal queues. This may lead to remote code execution on the Velociraptor server. Rapid7 Hosted Velociraptor instances are not affected by this vulnerability.
- Product
- Velociraptor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-39943 · Other software · directus · reported by GitHubMedium 6.5
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records (in directus_revisions) whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline, sensitive fields (including user tokens, two-factor authentication secrets, external auth identifiers, auth data, stored credentials, and AI provider API keys) could be stored in plaintext within revision records. This vulnerability is fixed in 11.17.0.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-39942 · Other software · directus · reported by GitHubHigh 8.5
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content while manipulating metadata fields such as uploaded_by to obscure the tampering. This vulnerability is fixed in 11.17.0.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026MStore API: Insecure Direct Object ReferenceCVE-2026-3568 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the update_user_profile() function in controllers/flutter-user.php processing the 'meta_data' JSON parameter without any allowlist, blocklist, or validation of meta keys. The function reads raw JSON from php://input (line 1012), decodes it (line 1013), authenticates the user via cookie validation (line 1015), and then directly iterates over the user-supplied meta_data array passing arbitrary keys and values to update_user_meta() (line 1080) with no sanitization or restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary user meta fields on their own accounts, including sensitive fields like wp_user_level (to escalate to administrator-level legacy checks), plugin-specific authorization flags (e.g., _wpuf_user_active, aiowps_account_status), and billing/profile fields with unsanitized values (potentially enabling Stored XSS in admin contexts). Note that wp_capabilities cannot be directly exploited this way because it requires a serialized array value, but wp_user_level (
- Product
- MStore API
- Affected
- up to 4.18.3
- What to do
- Affects up to 4.18.3. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026A weakness has been identified in atototo api-lab-mcp up to 0.2.1.CVE-2026-5832 · Other software · atototo · reported by VulDBMedium 5.5
A weakness has been identified in atototo api-lab-mcp up to 0.2.1. This affects the function analyze_api_spec/generate_test_scenarios/test_http_endpoint of the file src/mcp/http-server.ts of the component HTTP Interface. This manipulation of the argument source/url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- api-lab-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code exCVE-2026-4837 · Other software · Rapid7 · reported by cve@rapid7.comMedium 6.6
An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code execution as root via a crafted beacon response. Because the Agent uses mutual TLS (mTLS) to verify commands from the Rapid7 Platform, it is unlikely that the eval() function could be exploited remotely without prior, highly privileged access to the backend platform.
- Product
- Insight Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging CVE-2026-5600 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Medium 5.5
A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer. This allows an API consumer to access information for all other events under the same organizer, even those they should not have access to. These records contain information on the time and result of every ticket scan as well as the ID of the matched ticket. Example: { "id": 123, "successful": true, "error_reason": null, "error_explanation": null, "position": 321, "datetime": "2020-08-23T09:00:00+02:00", "list": 456, "created": "2020-08-23T09:00:00+02:00", "auto_checked_in": false, "gate": null, "device": 1, "device_id": 1, "type": "entry" } An unauthorized user usually has no way to match these IDs (position) back to individual people.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Rapid Car Check Vehicle Data: Missing AuthorizationCVE-2026-39687 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rapid Car Check Rapid Car Check Vehicle Data free-vehicle-data-uk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rapid Car Check Vehicle Data: from n/a through <= 2.0.
- Product
- Rapid Car Check Vehicle Data
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Rapid Car Check Vehicle Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 7, 2026Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used.CVE-2026-32289 · Other software · Go standard library · reported by security@golang.orgMedium 6.1
Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint.CVE-2025-56015 · Other software · Genieacs · reported by MITREHigh 7.5
In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint.
- Product
- Genieacs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Strawberry GraphQL is a library for creating GraphQL APIs.CVE-2026-35523 · Other software · strawberry-graphql · reported by GitHubHigh 7.5
Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connection_init handshake has been completed before processing start (subscription) messages. This allows a remote attacker to skip the on_ws_connect authentication hook entirely by connecting with the graphql-ws subprotocol and sending a start message directly, without ever sending connection_init. This vulnerability is fixed in 0.312.3.
- Product
- strawberry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Strawberry GraphQL is a library for creating GraphQL APIs.CVE-2026-35526 · Other software · strawberry-graphql · reported by GitHubHigh 7.5
Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection. An unauthenticated attacker can open a single WebSocket connection, send connection_init, and then flood subscribe messages with unique IDs. Each message unconditionally spawns a new asyncio.Task and async generator, causing linear memory growth and event loop saturation. This leads to server degradation or an OOM crash. This vulnerability is fixed in 0.312.3.
- Product
- strawberry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.CVE-2026-35521 · Other software · pi-hole · reported by GitHubHigh 8.8
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
- Product
- FTL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.CVE-2026-35520 · Other software · pi-hole · reported by GitHubHigh 8.8
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP lease time configuration parameter (dhcp.leaseTime). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
- Product
- FTL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.CVE-2026-35519 · Other software · pi-hole · reported by GitHubHigh 8.8
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.hostRecord). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
- Product
- FTL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.CVE-2026-35518 · Other software · pi-hole · reported by GitHubHigh 8.8
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dns.cnameRecords). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
- Product
- FTL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.CVE-2026-35517 · Other software · pi-hole · reported by GitHubHigh 8.8
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter (dns.upstreams). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
- Product
- FTL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.CVE-2026-35491 · Other software · pi-hole · reported by GitHubMedium 6.1
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, Pi-hole FTL supports a CLI password feature (webserver.api.cli_pw) that creates “CLI” API sessions intended to be read-only for configuration changes. While /api/config correctly blocks CLI sessions from mutating configuration, /api/teleporter allowed Teleporter imports for CLI sessions, enabling a CLI-scoped session to overwrite configuration via a Teleporter archive (authorization bypass). This vulnerability is fixed in 6.6.
- Product
- FTL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026An issue that could allow a user with access to a credential to view sensitive fields through an API response has been resolved.CVE-2026-5375 · Other software · runZero · reported by 44488dab-36db-4358-99f9-bc116477f914Low 2.7
An issue that could allow a user with access to a credential to view sensitive fields through an API response has been resolved. This is an instance of CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N (2.7 Low). This issue was fixed in version 4.0.260203.0 of the runZero Platform.
- Product
- Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.runzero.comrunzero.com
Apr 7, 2026Gotenberg is an API for converting document formats.CVE-2026-35458 · Other software · gotenberg · reported by GitHubHigh 8.7
Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely.
- Product
- gotenberg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApCVE-2026-22679 · Other software · Weaver Network Co., Ltd. · reported by VulnCheckCritical 9.3
Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).
- Product
- E-cology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh4cker.zipti.qianxin.com
Apr 6, 2026Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authenticated actoCVE-2026-5709 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 7.7
Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.
- Product
- Research and Engineering Studio (RES)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35442 · Other software · directus · reported by GitHubHigh 8.1
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the conceal special type incorrectly return raw database values instead of the masked placeholder. When combined with groupBy, any authenticated user with read access to the affected collection can extract concealed field values, including static API tokens and two-factor authentication secrets from directus_users. This vulnerability is fixed in 11.17.0.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35441 · Other software · directus · reported by GitHubMedium 6.5
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus' GraphQL endpoints (/graphql and /graphql/system) did not deduplicate resolver invocations within a single request. An authenticated user could exploit GraphQL aliasing to repeat an expensive relational query many times in a single request, forcing the server to execute a large number of independent complex database queries concurrently, multiplying database load linearly with the number of aliases. The existing token limit on GraphQL queries still permitted enough aliases for significant resource exhaustion, while the relational depth limit applied per alias without reducing the total number executed. Rate limiting is disabled by default, meaning no built-in throttle prevented this from causing CPU, memory, and I/O exhaustion that could degrade or crash the service. Any authenticated user, including those with minimal read-only permissions, could trigger this condition. This vulnerability is fixed in 11.17.0.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35413 · Other software · directus · reported by GitHubMedium 5.3
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQL_INTROSPECTION=false is configured, Directus correctly blocks standard GraphQL introspection queries (__schema, __type). However, the server_specs_graphql resolver on the /graphql/system endpoint returns an equivalent SDL representation of the schema and was not subject to the same restriction. This allowed the introspection control to be bypassed, exposing schema structure (collection names, field names, types, and relationships) to unauthenticated users at the public permission level, and to authenticated users at their permitted permission level. This vulnerability is fixed in 11.16.1.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35412 · Other software · directus · reported by GitHubHigh 7.1
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (/files/tus) allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only collection-level authorization checks, verifying the user has some permission on directus_files, but never validates item-level access to the specific file being replaced. As a result, row-level permission rules (e.g., "users can only update their own files") are completely bypassed via the TUS path while being correctly enforced on the standard REST upload path. This vulnerability is fixed in 11.16.1.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35411 · Other software · directus · reported by GitHubMedium 4.3
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus is vulnerable to an open redirect via the redirect query parameter on the /admin/tfa-setup page. When an administrator who has not yet configured Two-Factor Authentication (2FA) visits a crafted URL, they are presented with the legitimate Directus 2FA setup page. After completing the setup process, the application redirects the user to the attacker-controlled URL specified in the redirect parameter without any validation. This vulnerability could be used in phishing attacks targeting Directus administrators, as the initial interaction occurs on a trusted domain. This vulnerability is fixed in 11.16.1.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35410 · Other software · directus · reported by GitHubMedium 6.1
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, an open redirect vulnerability exists in the login redirection logic. The isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains upon successful authentication. This vulnerability is fixed in 11.16.1.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35409 · Other software · directus · reported by GitHubHigh 7.7
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private networks could be circumvented using IPv4-Mapped IPv6 address notation. This vulnerability is fixed in 11.16.0.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35408 · Other software · directus · reported by GitHubHigh 8.7
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header. Without this header, a malicious cross-origin window that opens the Directus login page retains the ability to access and manipulate the window object of that page. An attacker can exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account (e.g. Google, Discord). This vulnerability is fixed in 11.17.0.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026@hapi/content provided HTTP Content-* headers parsing.CVE-2026-35213 · Other software · hapijs · reported by GitHubHigh 8.7
@hapi/content provided HTTP Content-* headers parsing. All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking. This vulnerability is fixed in 6.0.1.
- Product
- content
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs.CVE-2026-35178 · Other software · forceworkbench · reported by GitHubCritical 9.3
Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbench contains remote code execution vulnerability in the timezone conversion flow, which processes attacker-controlled cookie values in an unsafe manner. This vulnerability is fixed in 65.0.0.
- Product
- forceworkbench
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.CVE-2026-35030 · Other software · BerriAI · reported by GitHubCritical 9.4
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt_auth: true), the OIDC userinfo cache uses token[:20] as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters. This configuration option is not enabled by default. Most instances are not affected. An unauthenticated attacker can craft a token whose first 20 characters match a legitimate user's cached token. On cache hit, the attacker inherits the legitimate user's identity and permissions. This affects deployments with JWT/OIDC authentication enabled. Fixed in v1.83.0.
- Product
- litellm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Apr 6, 2026LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.CVE-2026-35029 · Other software · BerriAI · reported by GitHubHigh 8.7
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.
- Product
- litellm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comseclists.org
Apr 6, 2026The whisperX API is a tool for enhancing and analyzing audio content.CVE-2026-34981 · Other software · pavelzbornik · reported by GitHubMedium 5.8
The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, FileService.download_from_url() in app/services/file_service.py calls requests.get(url) with zero URL validation. The file extension check occurs AFTER the HTTP request is already made, and can be bypassed by appending .mp3 to any internal URL. The /speech-to-text-url endpoint is unauthenticated. This vulnerability is fixed in 0.6.0.
- Product
- whisperX-FastAPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.