Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,797 results · page 5 of 56
Sep 29, 2026UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via CVE-2026-95307 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.4
UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 29, 2026UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via crafCVE-2026-95305 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.8
UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 29, 2026UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a craftCVE-2026-95294 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.4
UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 29, 2026UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page.CVE-2026-95288 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.4
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 29, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker ExtenCVE-2026-102796 · Other software · Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccHigh 7.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection. This issue affects Mediawiki - UserPageViewTracker Extension: from * before 1.46.1, 1.45.5, 1.43.10.
- Product
- Mediawiki - UserPageViewTracker Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Sep 28, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc.CVE-2026-86595 · Other software · Iron Mountain Archiving Services Inc. · reported by iletisim@usom.gov.trHigh 8.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection. This issue affects enVision: before 260655.
- Product
- enVision
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2026SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScrCVE-2026-100643 · Other software · siyuan-note · reported by VulnCheckHigh 8.5
SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with nodeIntegration enabled, this leads to command execution with SiYuan process privileges.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 25, 2026Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData ExtensCVE-2026-100382 · Other software · Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccCritical 10
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * before 3.7.
- Product
- Mediawiki - ExternalData Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Sep 25, 2026Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule.CVE-2026-18320 · Other software · Readwise · reported by cret@cert.orgMedium 6.1
Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).
- Product
- Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.CVE-2026-95832 · Other software · Kovid Goyal · reported by 4daa8cea-433a-44bd-9456-53b127fc289aCritical 9.3
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in kitty/screen.c then writes the reply to the pseudoterminal master, where it is not distinguishable from input typed by the user, without neutralising it for the shell that reads it. The payload is reduced to printable ASCII before the field name is echoed, which is the restriction introduced in 0.47.3 as the fix for CVE-2026-54057, and the record and field separators ; and = are consumed as delimiters, but every other printable character survives, which is sufficient to compose a shell command. A newline is available from handle_remote_ssh() in kitty/window.py, which writes the bytes yielded by get_ssh_data() in kittens/ssh/utils.py, the first of which begin with a newline, to the pseudoterminal master before any credential carried in the request is checked. The re
- Product
- kitty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve special fields in recycled rhtab elements rhtab_map_update_elem() initializeCVE-2026-98036 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve special fields in recycled rhtab elements rhtab_map_update_elem() initializes special fields after obtaining an element from bpf_mem_cache_alloc(). The allocator can return a fresh, zeroed unit, or recycle one from its RCU-pending lists before the registered destructor has run. A BPF program can retain a map-value pointer after deleting its element and initialize and arm a timer through that pointer. If the deleted unit is recycled, check_and_init_map_value() clears the only pointer to the timer. Neither a later deletion nor rhtab_mem_dtor() can then cancel it, and the callback can run with its key and value pointing into freed memory. Do not reinitialize special fields on insertion. Fresh allocator units are already zeroed. For recycled units, the special fields are ownership state that must remain visible to the eventual destructor. copy_map_value() already skips those fields, matching the non-preallocated hash-map path and the lifecycle established by commit 275c30bcee66 ("bpf: Don't reinit map value in prealloc_lru_pop"). [ kkd: Split out the fix and rewrote the commit log ]
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 25, 2026In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields when recycling rhtab elements rhtab_map_update_existing() and rCVE-2026-98035 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields when recycling rhtab elements rhtab_map_update_existing() and rhtab_delete_elem() call bpf_obj_free_fields() when replacing or deleting a value. These map operations can run from BPF programs in NMI context, where releasing a referenced kptr or another complex field is not generally safe. Array and hash maps avoid that problem by cancelling only the asynchronous fields which can be stopped safely in the caller context. Other ownership state remains attached to the allocation until its memory allocator destructor performs the final cleanup. Use bpf_obj_cancel_fields() for the corresponding rhtab paths as well. This cancels timers, workqueues, and task work while allowing rhtab_mem_dtor() to release referenced kptrs when the allocation is eventually destroyed. [ kkd: Rebased, used direct helper calls, and rewrote the commit log ]
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 24, 2026Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplCVE-2026-96744 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.1
Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value an application uses when acquiring or restoring a lock may take over or prematurely expire a lock held by another process, which can lead to duplicated or conflicting operations.
- Product
- Laravel MongoDB (PHP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026W4 Post List: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-96826 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6.
- Product
- W4 Post List
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update W4 Post List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.CVE-2026-94500 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.
- Affected
- up to 4.0.5
- What to do
- Affects up to 4.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when writteCVE-2026-6327 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.
- Product
- Concert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrarCVE-2026-75682 · Other software · Adobe · reported by AdobeCritical 9.9
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could resCVE-2026-82011 · Other software · Adobe · reported by AdobeCritical 9.1
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Campaign Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could resCVE-2026-82010 · Other software · Adobe · reported by AdobeCritical 9.9
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Campaign Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could resCVE-2026-82009 · Other software · Adobe · reported by AdobeCritical 9.1
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary SQL commands. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Campaign Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Karel Electronic Industry and Trade Inc.CVE-2026-12718 · Other software · Karel Electronic Industry and Trade Inc. · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Karel Electronic Industry and Trade Inc. KarelIPS allows Blind SQL Injection. This issue affects KarelIPS: through 22092026. NOTE: The vendor was contacted and it was learned that the product is not supported.
- Product
- KarelIPS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026HashBar – WordPress Notification Bar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-94117 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar – WordPress Notification Bar allows Blind SQL Injection. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.3.
- Product
- HashBar – WordPress Notification Bar
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update HashBar – WordPress Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 21, 2026A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parCVE-2026-91863 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
- Product
- Apache Neethi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 20, 2026Unlimited Elements For Elementor: Does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through itCVE-2026-85017 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.
- Product
- Unlimited Elements For Elementor
- Fixed in
- 2.0.20
- What to do
- Update Unlimited Elements For Elementor to 2.0.20 or newer.
Sep 19, 2026Wow Elements Addons for Elementor: Server-Side Request ForgeryCVE-2026-1641 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin passing user-controlled input from the 'Changelog File' setting directly to the wp_remote_get function without adequate validation or sanitization of the URL. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Wow Elements Addons for Elementor
- Affected
- up to 1.11.2
- What to do
- Affects up to 1.11.2. Update Wow Elements Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 18, 2026IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elementsCVE-2026-84239 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.6
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.
- Product
- Guardium Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elementsCVE-2026-84105 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.7
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.
- Product
- Guardium Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OCVE-2026-84085 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.
- Product
- Guardium Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an CVE-2026-84082 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
- Product
- Guardium Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS cCVE-2026-82892 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- Product
- Guardium Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements uCVE-2026-82887 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- Product
- Guardium Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) beforCVE-2026-4036 · Network & remote access · Synology · reported by security@synology.comMedium 6.5
An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files.
- Product
- DiskStation Manager (DSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSMCVE-2026-13683 · Network & remote access · Synology · reported by security@synology.comLow 2.7
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain non-sensitive information.
- Product
- DiskStation Manager (DSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate pCVE-2026-87701 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
- Product
- Azure Cosmos DB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a nCVE-2026-85885 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft 365 Copilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to CVE-2026-78501 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.6
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Copilot's Business Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via CVE-2026-93386 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.4
UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 17, 2026Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.CVE-2026-66608 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.
- Affected
- up to 2.0.19
- What to do
- Affects up to 2.0.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.CVE-2026-66579 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.
- Affected
- up to 2.9.2.1
- What to do
- Affects up to 2.9.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjCVE-2026-81476 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
- Product
- OpenManage Server Administrator Managed Node (Patch) for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint.CVE-2026-92589 · Other software · craftcms · reported by VulnCheckMedium 5.3
Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries (but without savePeerEntries) opens another author's entry in read-only mode, Craft unconditionally grants that session a `manageNestedElements::<ownerId>::field:<handle>` authorization flag for the entry's Matrix/Address fields. Unlike the corresponding delete endpoint, actions/nested-elements/reorder trusts this session flag alone and never rechecks the caller's save permission for the owner element. As a result, a view-only user can POST to actions/nested-elements/reorder using the ownerElementType, ownerId, ownerSiteId, attribute, elementIds, and offset parameters present in the read-only page source and rewrite the sort order of Matrix blocks or Addresses belonging to content they are explicitly denied save access to.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 16, 2026Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'CVE-2026-71179 · Other software · Dell · reported by security_alert@emc.comHigh 7.3
Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- Update Package Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sCVE-2026-92124 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection itself, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
- Product
- Jenkins Script Security Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web maCVE-2026-73176 · Other software · Advantech · reported by prodsec@nozominetworks.comHigh 8.6
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
- Product
- EKI-1242IEIMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvcloudfiles.advantech.comnozominetworks.com
Sep 16, 2026Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the edgserCVE-2026-73172 · Other software · Advantech · reported by prodsec@nozominetworks.comCritical 9.3
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the edgserver management service of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to execute arbitrary OS commands as root via crafted requests to TCP port 5058.
- Product
- EKI-1242IEIMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvcloudfiles.advantech.comnozominetworks.com
Sep 16, 2026Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web maCVE-2026-73167 · Other software · Advantech · reported by prodsec@nozominetworks.comHigh 8.6
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
- Product
- EKI-1242IEIMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvcloudfiles.advantech.comnozominetworks.com
Sep 16, 2026Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web maCVE-2026-73165 · Other software · Advantech · reported by prodsec@nozominetworks.comHigh 8.6
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
- Product
- EKI-1242IEIMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvcloudfiles.advantech.comnozominetworks.com
Sep 16, 2026Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web maCVE-2026-73164 · Other software · Advantech · reported by prodsec@nozominetworks.comHigh 8.6
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
- Product
- EKI-1242IEIMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvcloudfiles.advantech.comnozominetworks.com
Sep 16, 2026Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web maCVE-2026-73163 · Other software · Advantech · reported by prodsec@nozominetworks.comHigh 8.6
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
- Product
- EKI-1242IEIMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvcloudfiles.advantech.comnozominetworks.com
Sep 16, 2026WP Mega Menu: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-92465 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2.
- Product
- WP Mega Menu
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update WP Mega Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.