Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,755 results · page 5 of 56
Sep 8, 2026The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session.CVE-2026-78550 · Other software · Okta · reported by psirt@okta.comMedium 6.6
The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console.
- Product
- Okta Access Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit foCVE-2026-73318 · Other software · XenForo · reported by VulnCheckMedium 5.1
XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation configuration to update the global policy last-updated timestamp, forcing all users to re-agree to the privacy policy or terms of service.
- Product
- XenForo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbombobombone.github.iogithub.com
Sep 8, 2026XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuilCVE-2026-73317 · Other software · XenForo · reported by VulnCheckMedium 5.1
XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body. Attackers can invoke the approval queue job under any user identity to approve queued user registrations without holding the required approval-queue or moderator permissions, causing the moderation log to attribute actions to an impersonated account.
- Product
- XenForo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbombobombone.github.iogithub.com
Sep 8, 2026Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commaCVE-2026-85400 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 7.5
Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this allowed them, for example, to gain system maintainer privileges or cause a denial of service. Exploiting this vulnerability requires an administrator-level backend user account. This issue affects TYPO3 CMS versions 14.2.0-14.3.6.
- Product
- TYPO3 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modCVE-2026-86438 · Other software · laradashboard · reported by VulnCheckHigh 8.6
Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote code execution.
- Product
- laradashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentCVE-2026-86497 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.8
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescaCVE-2026-86118 · Other software · sentriz · reported by VulnCheckMedium 5.3
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.
- Product
- gonic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026EmbedPress: Does not correctly restrict access to one of its Google Reviews REST routes to administratorsCVE-2026-84926 · WordPress plugins & themes · reported by WPScanLow 2.7
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.
- Product
- EmbedPress
- Fixed in
- 4.6.4
- What to do
- Update EmbedPress to 4.6.4 or newer.
Sep 4, 2026ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools anCVE-2026-86091 · Other software · ntop · reported by VulnCheckHigh 7.1
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.
- Product
- ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Ninja Forms: Does not restrict its REST abilities to administratorsCVE-2026-80438 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.
- Product
- Ninja Forms
- Fixed in
- 3.15.2
- What to do
- Update Ninja Forms to 3.15.2 or newer.
Sep 4, 2026Hummingbird Performance: Does not restrict a network-wide setting to network administratorsCVE-2026-19224 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
- Product
- Hummingbird Performance
- Fixed in
- 3.21.2
- What to do
- Update Hummingbird Performance to 3.21.2 or newer.
Sep 3, 2026A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the CVE-2026-9854 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 8.5
A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.
- Product
- MicroSCADA SYS600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Sep 3, 2026SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevateCVE-2026-84830 · Other software · SEPPmail AG · reported by vulnerability@ncsc.chHigh 8.6
SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges.
- Product
- Secure Email Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloads.seppmail.com
Sep 2, 2026UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCVE-2026-82524 · Other software · unopim · reported by VulnCheckHigh 8.6
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response.
- Product
- unopim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordashutosh-jena.ingithub.com
Sep 2, 2026CatalogX: Does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administratorCVE-2026-79621 · WordPress plugins & themes · reported by WPScanMedium 4.3
The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry.
- Product
- CatalogX
- Fixed in
- 6.1.3
- What to do
- Update CatalogX to 6.1.3 or newer.
Sep 2, 2026JetBackup: Does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privilegesCVE-2026-19453 · WordPress plugins & themes · reported by WPScanHigh 7.1
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
- Product
- JetBackup
- Fixed in
- 3.1.23.5
- What to do
- Update JetBackup to 3.1.23.5 or newer.
Sep 1, 2026A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it.CVE-2024-7953 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could create, modify, and delete their own project.
- Product
- DataEdgePlatform DataMosaix™ Private Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Sep 1, 2026Simple Membership: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-77194 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1.
- Product
- Simple Membership
- Affected
- up to 4.8.0
- What to do
- Affects up to 4.8.0. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 1, 2026A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely.CVE-2026-4813 · Other software · Lutece · reported by cve-coordination@incibe.esCritical 9.4
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode (FEATURE_SECURE_PROCESSING), allowing Java extension functions to be executed from malicious XSL stylesheets. An attacker with administrator privileges can upload a manipulated XSL transformation file and trigger its execution during user export operations, resulting in the execution of arbitrary code on the server.
- Product
- Lutece Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-19806 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` — yielding approximately 19.5 bits of entropy — combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=<token>` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `w
- Product
- Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
- Affected
- up to 1.4.52
- What to do
- Affects up to 1.4.52. Update Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 31, 2026Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the administrator accounCVE-2026-51679 · Other software · reported by MITRECritical 9.1
Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail.CVE-2026-82860 · Other software · hulumi · reported by VulnCheckCritical 9.3
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.
- Product
- policies
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 30, 2026Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser.CVE-2026-77850 · Other software · ash-project · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.4
Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser. The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in <b> tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record's label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as <img src=x onerror=...> runs as JavaScript in the admin's session as soon as a matching record appears in the dropdown, giving the attacker the admin's privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup. This issue affects ash_admin: from 0.13.0 before 1.3.1.
- Product
- ash_admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Aug 30, 2026WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contCVE-2026-82647 · Other software · WWBN · reported by VulnCheckMedium 5.3
WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an authenticated admin, sends emails with attacker-controlled subject and body to arbitrary recipients, passing SPF/DKIM/DMARC validation for phishing and brand impersonation attacks.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 28, 2026Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocoCVE-2026-33606 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 4.8
Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not be able to set directly. It can also cause dsync errors. Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version. No publicly available exploits are known.
- Product
- OX Dovecot Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.open-xchange.com
Aug 27, 2026A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sendiCVE-2026-78618 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 6.9
A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request.
- Product
- Dimension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to executCVE-2026-78616 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 4.8
A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate.
- Product
- Dimension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection.CVE-2026-78610 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3High 8.4
WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the administrator's consent.
- Product
- Dimension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026A stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to injecCVE-2026-78047 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 5.1
A stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user.
- Product
- Dimension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of sCVE-2026-78008 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3High 8.6
A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a deCVE-2026-81851 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 6.9
A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadminCVE-2026-36102 · Other software · reported by MITREHigh 7.2
An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comoutline.joren2087.be
Aug 27, 2026Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write daCVE-2026-77991 · Websites & servers · reported by security@joomla.orgCritical 9.4
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjoomlaeventmanager.net
Aug 27, 2026Defender Security: Does not restrict a network-wide setting to network administratorsCVE-2026-19225 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
- Product
- Defender Security
- Fixed in
- 6.2.0
- What to do
- Update Defender Security to 6.2.0 or newer.
Aug 27, 2026Smush: Does not restrict a network-wide setting to network administratorsCVE-2026-19223 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
- Product
- Smush
- Fixed in
- 4.3.2
- What to do
- Update Smush to 4.3.2 or newer.
Aug 26, 2026An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local administrator to cause a system crash (BSOD) or BIOS corruptiCVE-2026-19398 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 6.8
An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local administrator to cause a system crash (BSOD) or BIOS corruption via a crafted software SMI (SW SMI) request with an oversized length value.Refer to the ' Security Update for ASUS FA507NV / FA507NU BIOS ' section on the ASUS Security Advisory for more information.
- Product
- FA507NV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recoverCVE-2026-19197 · Other software · Grafana · reported by security@grafana.comMedium 6.3
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process CommunicatiCVE-2026-78236 · Other software · Admin By Request (ABR) · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4High 8.8
An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.
- Product
- Admin By Request (ABR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.adminbyrequest.comcsa.gov.sg
Aug 26, 2026Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary CVE-2026-80198 · Other software · kimai · reported by VulnCheckHigh 8.7
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind passwords and SAML private keys into invoice or export documents accessible to lower-privileged users.
- Product
- kimai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 25, 2026Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding.CVE-2026-26211 · Other software · Creativeitem · reported by VulnCheckMedium 4.8
Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that page: the content attribute of the description meta element, the title element, and the text of an h4 element in the page header. The h4 occurrence is parsed as markup, so HTML placed in the system name field is rendered as markup and any event handler it carries runs. The login page is served without authentication, so the stored value executes in the browser of every visitor who loads it, including visitors who are not signed in, within the origin that serves the login form and alongside the credential fields on it. Storing the value requires an administrator session; the resulting script runs for unauthenticated visitors and persists until the setting is changed.
- Product
- Ekushey Project Manager CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netgithub.com
Aug 25, 2026NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands by sending a craftedCVE-2026-24167 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.8
NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands by sending a crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and information disclosure.
- Product
- Unified Fabric Manager Enterprise - GA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Aug 25, 2026Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs.CVE-2026-79666 · Other software · lin-snow · reported by VulnCheckHigh 7.1
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.
- Product
- Ech0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 24, 2026The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy CVE-2026-8173 · Other software · Murrelektronik · reported by info@cert.vde.comMedium 5.3
The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web interface can retrieve the logged MAC addresses via browser developer tools.
- Product
- Xelity 4TX M GE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2026privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privilegesCVE-2026-78155 · Other software · OnGres · reported by cve@gitlab.comCritical 9.9
privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges
- Product
- StackGres
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Forminator Forms: Does not restrict a network-wide setting to network administratorsCVE-2026-19221 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
- Product
- Forminator Forms
- Fixed in
- 1.57.0.5
- What to do
- Update Forminator Forms to 1.57.0.5 or newer.
Aug 21, 2026Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attckCVE-2026-27875 · Other software · Johnson Controls · reported by productsecurity@jci.comMedium 6.9
Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05.
- Product
- Simplex Incident Manager / Autocall Fire Administrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controlCVE-2026-77767 · Other software · reconmap · reported by VulnCheckHigh 8.7
Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs carries [AllowAnonymous] and therefore opts out of that policy. PreviewReport loads the Project row named by the id path segment, loads the linked Organisation through the project's ClientId, and renders both into default-report-template.html, which prints the project name and description together with the client organisation's name, address and URL. No authentication, project membership or role check is performed. Because the id is the auto-increment primary key of the project table, an unauthenticated remote caller can walk sequential ids to retrieve the engagement details and client organisation of every project on the instance, and the 404 returned for a missing id reveals which project ids exist. Reconmap stores penetration-testing engagements, so the disclosed descriptions and client records are sensitive by nature.
- Product
- reconmap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform patCVE-2026-77086 · Other software · siyuan-note · reported by VulnCheckCritical 9.4
SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 20, 2026OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitraryCVE-2026-76156 · Other software · Datiphy Inc. · reported by ART@zuso.aiCritical 9.4
OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root.
- Product
- Data Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitraryCVE-2026-53804 · Other software · Centuran Consulting · reported by VulnCheckHigh 8.6
OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration values are concatenated without sanitization into a shell command, enabling arbitrary command execution as the web server process user during normal ticket operations after the malicious configuration is deployed.
- Product
- OTRS Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh00die-gr3y.github.iovulncheck.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.