Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
977 results · page 5 of 20
Apr 9, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-39943 · Other software · directus · reported by GitHubMedium 6.5
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records (in directus_revisions) whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline, sensitive fields (including user tokens, two-factor authentication secrets, external auth identifiers, auth data, stored credentials, and AI provider API keys) could be stored in plaintext within revision records. This vulnerability is fixed in 11.17.0.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-39942 · Other software · directus · reported by GitHubHigh 8.5
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content while manipulating metadata fields such as uploaded_by to obscure the tampering. This vulnerability is fixed in 11.17.0.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Experto Dashboard for WooCommerce: Stored Cross-Site ScriptingCVE-2026-3574 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Experto Dashboard for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings fields (including 'Navigation Font Size', 'Navigation Font Weight', 'Heading Font Size', 'Heading Font Weight', 'Text Font Size', and 'Text Font Weight') in all versions up to and including 1.0.4. This is due to insufficient input sanitization (no sanitize callback in register_setting()) and missing output escaping (no esc_attr() in the field_callback() printf output) on user-supplied values. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever a user accesses the settings page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Experto Dashboard for WooCommerce
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Experto Dashboard for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 7, 2026Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5CVE-2026-3466 · Other software · Checkmk GmbH · reported by security@checkmk.comHigh 8.5
Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting (XSS) attacks by tricking a victim into clicking a crafted dashlet title link on a shared dashboard.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheckmk.comcheckmk.com
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35442 · Other software · directus · reported by GitHubHigh 8.1
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the conceal special type incorrectly return raw database values instead of the masked placeholder. When combined with groupBy, any authenticated user with read access to the affected collection can extract concealed field values, including static API tokens and two-factor authentication secrets from directus_users. This vulnerability is fixed in 11.17.0.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35441 · Other software · directus · reported by GitHubMedium 6.5
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus' GraphQL endpoints (/graphql and /graphql/system) did not deduplicate resolver invocations within a single request. An authenticated user could exploit GraphQL aliasing to repeat an expensive relational query many times in a single request, forcing the server to execute a large number of independent complex database queries concurrently, multiplying database load linearly with the number of aliases. The existing token limit on GraphQL queries still permitted enough aliases for significant resource exhaustion, while the relational depth limit applied per alias without reducing the total number executed. Rate limiting is disabled by default, meaning no built-in throttle prevented this from causing CPU, memory, and I/O exhaustion that could degrade or crash the service. Any authenticated user, including those with minimal read-only permissions, could trigger this condition. This vulnerability is fixed in 11.17.0.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35413 · Other software · directus · reported by GitHubMedium 5.3
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQL_INTROSPECTION=false is configured, Directus correctly blocks standard GraphQL introspection queries (__schema, __type). However, the server_specs_graphql resolver on the /graphql/system endpoint returns an equivalent SDL representation of the schema and was not subject to the same restriction. This allowed the introspection control to be bypassed, exposing schema structure (collection names, field names, types, and relationships) to unauthenticated users at the public permission level, and to authenticated users at their permitted permission level. This vulnerability is fixed in 11.16.1.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35412 · Other software · directus · reported by GitHubHigh 7.1
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (/files/tus) allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only collection-level authorization checks, verifying the user has some permission on directus_files, but never validates item-level access to the specific file being replaced. As a result, row-level permission rules (e.g., "users can only update their own files") are completely bypassed via the TUS path while being correctly enforced on the standard REST upload path. This vulnerability is fixed in 11.16.1.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35411 · Other software · directus · reported by GitHubMedium 4.3
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus is vulnerable to an open redirect via the redirect query parameter on the /admin/tfa-setup page. When an administrator who has not yet configured Two-Factor Authentication (2FA) visits a crafted URL, they are presented with the legitimate Directus 2FA setup page. After completing the setup process, the application redirects the user to the attacker-controlled URL specified in the redirect parameter without any validation. This vulnerability could be used in phishing attacks targeting Directus administrators, as the initial interaction occurs on a trusted domain. This vulnerability is fixed in 11.16.1.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35410 · Other software · directus · reported by GitHubMedium 6.1
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, an open redirect vulnerability exists in the login redirection logic. The isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains upon successful authentication. This vulnerability is fixed in 11.16.1.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35409 · Other software · directus · reported by GitHubHigh 7.7
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private networks could be circumvented using IPv4-Mapped IPv6 address notation. This vulnerability is fixed in 11.16.0.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-35408 · Other software · directus · reported by GitHubHigh 8.7
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header. Without this header, a malicious cross-origin window that opens the Directus login page retains the ability to access and manipulate the window object of that page. An attacker can exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account (e.g. Google, Discord). This vulnerability is fixed in 11.17.0.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Homarr is an open-source dashboard.CVE-2026-33510 · Other software · homarr-labs · reported by GitHubHigh 8.8
Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has been discovered in Homarr's /auth/login page. The application improperly trusts a URL parameter (callbackUrl), which is passed to redirect and router.push. An attacker can craft a malicious link that, when opened by an authenticated user, performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. This vulnerability is fixed in 1.57.0.
- Product
- homarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Homarr is an open-source dashboard.CVE-2026-32602 · Other software · homarr-labs · reported by GitHubMedium 4.2
Homarr is an open-source dashboard. Prior to 1.57.0, the user registration endpoint (/api/trpc/user.register) is vulnerable to a race condition that allows an attacker to create multiple user accounts from a single-use invite token. The registration flow performs three sequential database operations without a transaction: CHECK, CREATE, and DELETE. Because these operations are not atomic, concurrent requests can all pass the validation step (1) before any of them reaches the deletion step (3). This allows multiple accounts to be registered using a single invite token that was intended to be single-use. This vulnerability is fixed in 1.57.0.
- Product
- homarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Incorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the shipping/receiving role to view the truck's dashboard resources.CVE-2026-31150 · Other software · Kaleris · reported by MITREMedium 4.3
Incorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the shipping/receiving role to view the truck's dashboard resources.
- Product
- Yard Management Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights could allow an authenticated, remote attacker to write arbitrary files to an afCVE-2026-20174 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.9
A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights could allow an authenticated, remote attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient validation of the metadata update file. An attacker could exploit this vulnerability by crafting a metadata update file and manually uploading it to an affected device. A successful exploit could allow the attacker to write arbitrary files to the underlying operating system as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. Note: Manual uploading of metadata files is typical for Air-Gap environments but not for Cisco Intersight Cloud connected devices. However, the manual upload option exists for both deployments.
- Product
- Cisco Nexus Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Apr 1, 2026A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and access to Full or ConfiCVE-2026-20042 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and access to Full or Config-only backup files to access sensitive information. This vulnerability exists because authentication details are included in the encrypted backup files. An attacker with a valid backup file and encryption password from an affected device could decrypt the backup file. The attacker could then use the authentication details in the backup file to access internal-only APIs on the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.
- Product
- Cisco Nexus Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Apr 1, 2026A vulnerability in Cisco Nexus Dashboard and Cisco Nexus Dashboard Insights could allow an unauthenticated, remote attacker to conduct a server-side request forCVE-2026-20041 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in Cisco Nexus Dashboard and Cisco Nexus Dashboard Insights could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by persuading an authenticated user of the device management interface to click a crafted link. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device to an attacker-controlled server. The attacker could then execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.
- Product
- Cisco Nexus Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Apr 1, 2026A reflected cross-site scripting (XSS) vulnerability in the dashboard search functionality of the VertiGIS FM solution allows attackers to craft a malicious URLCVE-2026-3877 · Other software · VertiGIS · reported by vulnerability@ncsc.chHigh 7.3
A reflected cross-site scripting (XSS) vulnerability in the dashboard search functionality of the VertiGIS FM solution allows attackers to craft a malicious URL, that if visited by an authenticated victim, will execute arbitrary JavaScript in the victim's context. Such a URL could be delivered through various means, for instance, by sending a link or by tricking victims to visit a page crafted by the attacker.
- Product
- VertiGIS FM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a maliciCVE-2026-0397 · Other software · PowerDNS · reported by security@open-xchange.comLow 3.1
When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamicCVE-2026-0396 · Other software · PowerDNS · reported by security@open-xchange.comLow 3.1
An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.CVE-2026-27877 · Other software · Grafana · reported by security@grafana.comMedium 6.5
When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comaccess.redhat.com
Mar 26, 2026Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.ThisCVE-2026-3527 · Websites & servers · reported by mlhess@drupal.orgMedium 6.5
Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Dashboard: from 0.0.0 before 3.1.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2026UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of dataCVE-2026-2294 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'uip_save_global_settings' function in all versions up to, and including, 3.5.09. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings.
- Product
- UiPress lite | Effortless custom dashboards, admin themes and pages
- Affected
- up to 3.5.09
- What to do
- Affects up to 3.5.09. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 17, 2026A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1.CVE-2026-32981 · Other software · ray-project · reported by VulnCheckHigh 8.7
A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.
- Product
- Ray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstorm.news
Mar 11, 2026ExactMetrics – Google Analytics Dashboard for: Improper Privilege ManagementCVE-2026-1993 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the `update_settings()` function accepting arbitrary plugin setting names without a whitelist of allowed settings. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to modify any plugin setting, including the `save_settings` option that controls which user roles have access to plugin functionality. The admin intended to delegate configuration access to a trusted user, not enable that user to delegate access to everyone. By setting `save_settings` to include `subscriber`, an attacker can grant plugin administrative access to all subscribers on the site.
- Product
- ExactMetrics – Google Analytics Dashboard for
- Affected
- up to 9.0.2
- What to do
- Affects up to 9.0.2. Update ExactMetrics – Google Analytics Dashboard for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 11, 2026ExactMetrics – Google Analytics Dashboard for: Insecure Direct Object ReferenceCVE-2026-1992 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Insecure Direct Object Reference in versions 8.6.0 through 9.0.2. This is due to the `store_settings()` method in the `ExactMetrics_Onboarding` class accepting a user-supplied `triggered_by` parameter that is used instead of the current user's ID to check permissions. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to bypass the `install_plugins` capability check by specifying an administrator's user ID in the `triggered_by` parameter, allowing them to install arbitrary plugins and achieve Remote Code Execution. This vulnerability only affects sites on which administrator has given other user types the permission to view reports and can only be exploited by users of that type.
- Product
- ExactMetrics – Google Analytics Dashboard for
- Affected
- up to 9.0.2
- What to do
- Affects up to 9.0.2. Update ExactMetrics – Google Analytics Dashboard for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 10, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-30862 · Other software · appsmithorg · reported by GitHubCritical 9
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the "Invite Users" feature, an attacker with a regular user account (user@gmail.com) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Homarr is an open-source dashboard.CVE-2026-27797 · Other software · homarr-labs · reported by GitHubMedium 5.3
Homarr is an open-source dashboard. Prior to version 1.54.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows a remote attacker to force the Homarr server to perform arbitrary outbound HTTP requests. This can be used as an internal network access primitive (e.g., reaching loopback/private ranges) from the Homarr host/container network context. This issue has been patched in version 1.54.0.
- Product
- homarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Homarr is an open-source dashboard.CVE-2026-27796 · Other software · homarr-labs · reported by GitHubMedium 5.3
Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service URLs, integration names, and service types. This issue has been patched in version 1.54.0.
- Product
- homarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper validation on an input parameter.CVE-2025-40894 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comLow 2.1
A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper validation on an input parameter. A malicious authenticated user with the required privileges could edit a node label to inject HTML tags. If the system is configured to use the Alerted Nodes Dashboard, and alerts are reported for the affected node, then the injected HTML may render in the browser of a victim user interacting with it, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.nozominetworks.comcert-portal.siemens.com
Feb 25, 2026Disable Admin Notices – Hide Dashboard Notifications: Cross-Site Request ForgeryCVE-2026-2410 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Disable Admin Notices – Hide Dashboard Notifications plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing nonce validation in the `showPageContent()` function. This makes it possible for unauthenticated attackers to add arbitrary URLs to the blocked redirects list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Disable Admin Notices – Hide Dashboard Notifications
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Disable Admin Notices – Hide Dashboard Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 24, 2026Parse Dashboard is a standalone dashboard for managing Parse Server apps.CVE-2026-27610 · Other software · parse-community · reported by GitHubHigh 7
Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the `ConfigKeyCache` uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. The fix in version 9.0.0-alpha.8 uses distinct cache keys for master key and read-only master key. As a workaround, avoid using function-typed master keys, or remove the `agent` configuration block from your dashboard configuration.
- Product
- parse-dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Parse Dashboard is a standalone dashboard for managing Parse Server apps.CVE-2026-27609 · Other software · parse-community · reported by GitHubHigh 8.3
Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session. The fix in version 9.0.0-alpha.8 adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected.
- Product
- parse-dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Parse Dashboard is a standalone dashboard for managing Parse Server apps.CVE-2026-27608 · Other software · parse-community · reported by GitHubCritical 9.3
Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform write and delete operations. Only dashboards with `agent` configuration enabled are affected. The fix in version 9.0.0-alpha.8 adds per-app authorization checks and restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side. As a workaround, remove the `agent` configuration block from your dashboard configuration. Dashboards without an `agent` config are not affected.
- Product
- parse-dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Parse Dashboard is a standalone dashboard for managing Parse Server apps.CVE-2026-27595 · Other software · parse-community · reported by GitHubCritical 9.9
Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (POST `/apps/:appId/agent`) has multiple security vulnerabilities that, when chained, allow unauthenticated remote attackers to perform arbitrary read and write operations against any connected Parse Server database using the master key. The agent feature is opt-in; dashboards without an agent config are not affected. The fix in version 9.0.0-alpha.8 adds authentication, CSRF validation, and per-app authorization middleware to the agent endpoint. Read-only users are restricted to the `readOnlyMasterKey` with write permissions stripped server-side. A cache key collision between master key and read-only master key was also corrected. As a workaround, remove or comment out the agent configuration block from your Parse Dashboard configuration.
- Product
- parse-dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026E Learning Script 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard without valid credentials by manipulating loCVE-2019-25320 · Other software · amitkolloldey · reported by VulnCheckHigh 8.8
E Learning Script 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard without valid credentials by manipulating login parameters. Attackers can exploit the /login.php file by sending a specific payload '=''or' to bypass authentication and gain unauthorized access to the system.
- Product
- elearning-script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 12, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-26185 · Other software · directus · reported by GitHubMedium 5.3
Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard.CVE-2026-21722 · Other software · Grafana · reported by security@grafana.comMedium 5.3
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any annotations that would not otherwise be visible on the public dashboard.
- Product
- grafana/grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026BloodX 1.0 contains an authentication bypass vulnerability in login.php that allows attackers to access the dashboard without valid credentials.CVE-2020-37156 · Other software · diveshlunker · reported by VulnCheckMedium 6.9
BloodX 1.0 contains an authentication bypass vulnerability in login.php that allows attackers to access the dashboard without valid credentials. Attackers can exploit the vulnerability by sending a crafted payload with '=''or' parameters to bypass login authentication and gain unauthorized access.
- Product
- BloodX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25951 · Other software · frangoteam · reported by GitHubHigh 8.6
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.11, there is a flaw in the path sanitization logic allows an authenticated attacker with administrative privileges to bypass directory traversal protections. By using nested traversal sequences (e.g., ....//), an attacker can write arbitrary files to the server filesystem, including sensitive directories like runtime/scripts. This leads to Remote Code Execution (RCE) when the server reloads the malicious scripts. This vulnerability is fixed in 1.2.11.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25939 · Other software · frangoteam · reported by GitHubCritical 9.3
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25938 · Other software · frangoteam · reported by GitHubCritical 9.5
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has been patched in FUXA version 1.2.11.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25895 · Other software · frangoteam · reported by GitHubCritical 9.5
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25894 · Other software · frangoteam · reported by GitHubCritical 9.5
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not configured. This issue has been patched in FUXA version 1.2.10.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25893 · Other software · frangoteam · reported by GitHubCritical 10
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Homarr is an open-source dashboard.CVE-2026-25123 · Other software · homarr-labs · reported by GitHubMedium 5.3
Homarr is an open-source dashboard. Prior to 1.52.0, a public (unauthenticated) tRPC endpoint widget.app.ping accepts an arbitrary url and performs a server-side request to that URL. This allows an unauthenticated attacker to trigger outbound HTTP requests from the Homarr server, enabling SSRF behavior and a reliable port-scanning primitive (open vs closed ports can be inferred from statusCode vs fetch failed and timing). This vulnerability is fixed in 1.52.0.
- Product
- homarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25752 · Other software · frangoteam · reported by GitHubCritical 9.3
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and overwrite arbitrary device tags or disable communication drivers, exposing connected ICS/SCADA environments to follow-on actions. This may allow an attacker to manipulate physical processes and disconnected devices from the HMI. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25751 · Other software · frangoteam · reported by GitHubCritical 9.1
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of these credentials may allow an attacker to authenticate directly to the database service, enabling them to read, modify, or delete all historical process data, or perform a Denial of Service by corrupting the database. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2026SunFounder Pironman Dashboard (pm_dashboard) version 1.3.13 and prior contain a path traversal vulnerability in the log file API endpoints.CVE-2026-25069 · Other software · SunFounder · reported by VulnCheckCritical 9.3
SunFounder Pironman Dashboard (pm_dashboard) version 1.3.13 and prior contain a path traversal vulnerability in the log file API endpoints. An unauthenticated remote attacker can supply traversal sequences via the filename parameter to read and delete arbitrary files. Successful exploitation can disclose sensitive information and delete critical system files, resulting in data loss and potential system compromise or denial of service.
- Product
- Pironman Dashboard (pm_dashboard)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.