Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,382 results · page 5 of 28
Aug 30, 2026A vulnerability was determined in Open5GS up to 2.7.7.CVE-2026-82587 · Other software · reported by VulDBLow 2.1
A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function amf_namf_comm_decode_ue_mm_context_list of the file src/amf/namf-handler.c of the component AMF. This manipulation of the argument ueContext.mmContextList[*].allowedNssai causes memory corruption. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.8.0 is able to resolve this issue. Patch name: abf8a836564b966b5141110fc25ed413c4f17522. It is recommended to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026A vulnerability was determined in Linux Foundation Magma 1.9.0.CVE-2026-82548 · Computers, phones & browsers · Linux Foundation · reported by VulDBMedium 5.5
A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Magma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :argsCVE-2026-78038 · Other software · ash-project · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbMedium 5.9
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :args option of AshOban.build_trigger/3 to retarget an update or destroy trigger at another record, including across tenants. build_trigger/3 builds the trusted job arguments with atom keys (:primary_key, :tenant, :action_arguments) and merges the caller's :args underneath so the trusted values win on collision. Because Oban job arguments round-trip through JSON, the caller's keys arrive as strings, so Map.merge sees no collision and both keys survive. When the job is persisted the JSON object is de-duplicated keeping the last (string) key, and the worker reads the caller's value. The documentation describes :args as unable to affect the action, so an application that forwards user input into it for uniqueness scoping is exposed to authorization bypass and tenant isolation breaks. This issue affects ash_oban: from 0.2.5 before 0.8.14.
- Product
- ash_oban
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Aug 30, 2026A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509.CVE-2026-82539 · Other software · TOTOLINK · reported by VulDBHigh 8.5
A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function setMacFilterRules of the file cstecgi.cgi of the component MAC Filtering. Executing a manipulation of the argument desc can lead to memory corruption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- A720R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026A vulnerability was determined in Beetel 450TC3 01.00.00_01.CVE-2026-82487 · Other software · Beetel · reported by VulDBLow 2.1
A vulnerability was determined in Beetel 450TC3 01.00.00_01. This affects an unknown part. Executing a manipulation can lead to weak password recovery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 450TC3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026A vulnerability was determined in NASA Trick 19.6.0.CVE-2026-82478 · Other software · NASA · reported by VulDBMedium 6.9
A vulnerability was determined in NASA Trick 19.6.0. This issue affects the function JSONVariableServerThread::parse_request of the file trick_source/sim_services/JSONVariableServer/JSONVariableServerThread.cpp of the component TCP Socket Handler. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Trick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapp.notion.comvuldb.com
Aug 27, 2026A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2.CVE-2026-81848 · Other software · cyberchitta · reported by VulDBMedium 5.1
A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function s_fetch_page/s_fetch_pattern of the file src/scrapling_fetch_mcp/_fetcher.py. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. Upgrading to version 0.2.3 is sufficient to resolve this issue. This patch is called 9f6f34e92c55c3d95566ad9c62aca7327d24533a. Upgrading the affected component is advised.
- Product
- scrapling-fetch-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file.CVE-2026-47852 · Other software · Spring · reported by security@vmware.comHigh 7.5
A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9
- Product
- Spring AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production eCVE-2026-55585 · Other software · QWED-AI · reported by GitHubHigh 8.8
QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parse_expr() without restricted global_dict and local_dict namespaces, allowing Python eval() to resolve builtins and execute arbitrary Python code in the API server process. In src/qwed_new/api/main.py, POST /verify/math is protected by get_current_tenant but accepts any valid tenant API key, reads the expression field, applies only a cosmetic re.sub(r'(\d)(()', r'\1*\2', expression) normalization, and passes the result to parse_expr(). In src/qwed_new/core/batch.py, POST /verify/batch sends math items through batch_service.create_job(), stores item.query verbatim, and _verify_item() passes VerificationType.MATH input to parse_expr() without sanitization. The default-enabled POST /auth/signup endpoint allows anyone to create a standard tenant account, POST /auth/api-keys issues an x-api-key, and either vulnerable path can then be used to read or write files, modify data, execute operating system commands, terminate the ser
- Product
- qwed-verification
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026QWED-MCP is a deterministic verification gateway for MCP.CVE-2026-55546 · Other software · QWED-AI · reported by GitHubCritical 9.8
QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to SymPy's parse_expr() after only normalizing caret syntax to Python exponent syntax, without restricting global_dict, removing Python built-ins, or validating the expression AST. Because parse_expr() calls Python's eval() with built-ins available, an attacker who can cause a downstream caller to pass untrusted input to this public library function can use Python import functionality to execute arbitrary operating-system commands as the qwed-mcp process user, read or modify accessible data, exfiltrate process secrets, or reach internal services. The default MCP tool registry does not expose verify_math_expression(), so exploitation requires a downstream integration that invokes the library API with attacker-controlled input. This issue is fixed in version 0.2.1.
- Product
- qwed-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026A vulnerability was determined in liketrek TREK up to 3.0.22.CVE-2026-78864 · Other software · liketrek · reported by VulDBMedium 5.3
A vulnerability was determined in liketrek TREK up to 3.0.22. The affected element is the function journeyService.updateEntry of the file server/src/nest/journey/journey.controller.t of the component Journey Entry Update. This manipulation causes sql injection. It is possible to initiate the attack remotely. Upgrading to version 3.1.0 is sufficient to fix this issue. It is recommended to upgrade the affected component.
- Product
- TREK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2026A vulnerability was determined in jQWidgets up to 24.0.1.CVE-2026-78178 · Other software · reported by VulDBMedium 6.9
A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The reported GitHub issue was closed with the label "not planned".
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2026A vulnerability was determined in ggml-org llama.cpp bec4772f6.CVE-2026-78148 · Other software · ggml-org · reported by VulDBMedium 6.9
A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.
- Product
- llama.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2026A vulnerability was determined in vas3k TaxHacker up to 0.8.2.CVE-2026-78061 · Other software · vas3k · reported by VulDBMedium 5.3
A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
- Product
- TaxHacker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026A vulnerability was determined in alexta69 MeTube up to 2026.06.10.CVE-2026-78051 · Other software · alexta69 · reported by VulDBMedium 5.5
A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2026.06.20 is sufficient to resolve this issue. Patch name: ce897ee00903bf7ded406f0d7852d95dd4164add. You should upgrade the affected component.
- Product
- MeTube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05.CVE-2026-77946 · Other software · TRENDnet · reported by VulDBCritical 9.3
A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected by this vulnerability is the function uci_safe_get of the file /cgi-bin/apply_time.cgi of the component NTP Timezone Configuration Handler. Executing a manipulation of the argument system.ntp.server/system.ntp.enable_server/cameo.time.time_zone/cameo.cameo.syslog_server can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- TEW-821DAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0.CVE-2026-77019 · Other software · CodeAstro · reported by VulDBMedium 5.5
A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Apartment Visitor Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Aug 20, 2026A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0.CVE-2026-76993 · Other software · GreyDGL · reported by VulDBLow 1.3
A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the component Web-Page Crawling. Executing a manipulation of the argument Traceback can lead to injection. The attack can be executed remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The reported GitHub issue was closed with the label "not planned".
- Product
- PentestGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05.CVE-2026-76582 · Other software · TRENDnet · reported by VulDBLow 2.1
A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected is the function popen/system of the file /cgi-bin/ping.cgi of the component ssi. Executing a manipulation of the argument ipaddr can lead to command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- TEW-821DAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026A vulnerability was determined in karakeep-app karakeep up to 0.32.0.CVE-2026-75774 · Other software · karakeep-app · reported by VulDBLow 2.9
A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- karakeep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers.CVE-2026-75109 · Other software · determined-ai · reported by VulnCheckHigh 7.1
Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own.
- Product
- determined
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922.CVE-2026-74843 · Other software · Wavlink · reported by VulDBCritical 9.3
A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi of the component Export Pingortrace CGI. Executing a manipulation of the argument HTTP_COOKIE can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
- Product
- WN531P3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinisCVE-2026-74889 · Other software · jahlives · reported by VulnCheckCritical 9.3
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.
- Product
- openssl_encrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 17, 2026A vulnerability was determined in Webkul Bagisto up to 2.4.4.CVE-2026-19995 · Other software · Webkul · reported by VulDBLow 2
A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
- Product
- Bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2026A vulnerability was determined in automad up to 2.0.0-beta.32.CVE-2026-19965 · Other software · reported by VulDBLow 2.9
A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes observable response discrepancy. The attack can be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.0.0-beta.33 is able to resolve this issue. Patch name: eac0b05dafdb0ddf8b9139dad8929aaba86568ca. You should upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2026A vulnerability was determined in OpenBoxes up to 0.9.7.CVE-2026-19928 · Other software · reported by VulDBLow 2.1
A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.8-hotfix1 and 0.9.8 mitigates this issue. This patch is called 788cace0af816aa972a713a4631c57f16f895e6b. Upgrading the affected component is recommended.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 15, 2026A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02.CVE-2026-19891 · Other software · TRENDnet · reported by VulDBMedium 6.3
A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchange_mode causes missing encryption of sensitive data. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The vendor was contacted early about this disclosure.
- Product
- TEW-WLC100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapp.notion.comvuldb.com
Aug 15, 2026In the Linux kernel, the following vulnerability has been resolved: spi: xilinx: use FIFO occupancy register to determine buffer size The method the driver usCVE-2026-74276 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: spi: xilinx: use FIFO occupancy register to determine buffer size The method the driver uses to determine the size of the FIFO has a problem. What it currently does is this: It stops the SPI hardware and writes to the TX FIFO register until TX FIFO FULL asserts in the status register. But the hardware does not only have the FIFO, it also has a shift register which can hold a byte. This can be seen, when writing a byte to the FIFO (while the SPI hardware is stopped,) the TX FIFO EMPTY is still empty. So, if we have a FIFO size of 16 for example, the current method returns a 17. This is a problem, at least when using the driver in irq mode. The same size determined for the TX FIFO is also assumed for the RX FIFO. When a SPI transaction wants to write the amount of the FIFO size or more bytes, the following happens, for example with 16 bytes FIFO size: The driver stops the SPI hardware and writes 17 bytes to the TX FIFO and starts the SPI hardware and goes sleep. The hardware then shifts out 17 bytes (FIFO + shift register) and simultaneously reads bytes into the RX FIFO, but it only has 16 places, so it looses one
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 14, 2026A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730.CVE-2026-19845 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. Executing a manipulation of the argument Comment can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- A800R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026A vulnerability was determined in Webkul Bagisto up to 2.4.4.CVE-2026-19834 · Other software · Webkul · reported by VulDBLow 2
A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
- Product
- Bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01.CVE-2026-19821 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- AC12
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01.CVE-2026-19789 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects the function set_wl_guest_iplist of the file /goform/WifiGuestSet of the component httpd web management interface. This manipulation of the argument shareSpeed causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- AC1206
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026A vulnerability was determined in DTStack Taier 1.4.0.CVE-2026-19763 · Other software · DTStack · reported by VulDBMedium 5.1
A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the component Cluster Creation. This manipulation of the argument clusterName causes path traversal. Remote exploitation of the attack is possible. Upgrading to version 1.5.0 can resolve this issue. Patch name: ec8c59c76aceb04ab3080543ab2d9c6a4b674729. The affected component should be upgraded.
- Product
- Taier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026A vulnerability was determined in dromara lamp-cloud up to 5.10.0.CVE-2026-19758 · Other software · dromara · reported by VulDBMedium 5.5
A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- lamp-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can CVE-2026-72655 · Other software · Elastic · reported by security@elastic.coMedium 4.3
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating User-Controlled Variables (CAPEC-77). Object attributes accepted by the case management API were not subject to the same authorization enforcement applied in the user interface, so a low-privileged user could alter case records they were only entitled to view.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparisCVE-2026-72643 · Other software · Elastic · reported by security@elastic.coHigh 7.1
Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that share a username in different realms are treated as the same owner. This discloses the configuration and instructions of an agent the caller does not own, and allows that agent to be altered or removed.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A vulnerability was determined in Open5GS up to 2.7.1.CVE-2024-14043 · Other software · reported by VulDBLow 2.1
A vulnerability was determined in Open5GS up to 2.7.1. This vulnerability affects the function mme_s6a_subscription_data_from_avp of the file src/mme/mme-fd-path.c of the component Diameter S6a Interface. Executing a manipulation of the argument msisdn_len can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.7.2 is able to resolve this issue. This patch is called 7ea82cb87bb65c3694d8d7c7a5efed1c4d3c9304. Upgrading the affected component is recommended.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home diCVE-2026-6791 · Other software · The GNU C Library · reported by 3ff69d7a-14f2-4f67-a097-88dee7810d18Medium 6.6
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.
- Product
- glibc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address iCVE-2026-72588 · Other software · bluewave-labs · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 5.3
A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts.
- Product
- Checkmate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A vulnerability was determined in EFM ipTIME AX8004M 15.09.0.CVE-2026-19379 · Other software · EFM · reported by VulDBMedium 5.5
A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ipTIME AX8004M
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0.CVE-2026-19370 · Other software · bartekke8it56w2 · reported by VulDBLow 1.9
A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes path traversal. The attack requires local access. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- new-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A vulnerability was determined in MingSoft MCMS up to 3.0.6.CVE-2026-19355 · Other software · MingSoft · reported by VulDBMedium 5.5
A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A vulnerability was determined in mifi lossless-cut up to 3.69.0.CVE-2026-19352 · Other software · mifi · reported by VulDBLow 1.3
A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the local network. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 260802348955231442c4bae6c2d9d8ede947af0a. It is best practice to apply a patch to resolve this issue. The project maintainer provides this view: "I'm not sure that this is a critical vulnerability, because it is behind an experimental CLI flag and the NTLM behavior isn't really a LosslessCut bug." The CVSS vector reflects the high level of pre-requisites.
- Product
- lossless-cut
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2026-19346 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Aug 9, 2026A vulnerability was determined in adenot mcp-google-search up to 0.3.1.CVE-2026-19337 · Other software · adenot · reported by VulDBLow 1.9
A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component read_webpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This patch is called f071d491b685011ca04e8ab8d586fc65f86bcee1. It is advisable to implement a patch to correct this issue.
- Product
- mcp-google-search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0.CVE-2026-19330 · Other software · angrysky56 · reported by VulDBLow 1.9
A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0. The impacted element is the function create_system_json/create_library to get_system_json/switch_memory_library of the file src/index.ts. This manipulation causes path traversal. The attack requires local access. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- advanced-reasoning-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2026A vulnerability was determined in Kirachon context-engine up to 1.9.0.CVE-2026-19266 · Other software · Kirachon · reported by VulDBMedium 5.1
A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1 mitigates this issue. This patch is called e0729dcfd3a2b1682a7bff86e7174852c03419ba. It is advisable to upgrade the affected component.
- Product
- context-engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026A vulnerability was determined in WonderTrader up to 0.9.9.CVE-2026-19212 · Other software · reported by VulDBLow 2.1
A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument m_offsetType can lead to use of uninitialized variable. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026A vulnerability was determined in DataGear up to 5.0.0.CVE-2026-19110 · Other software · reported by VulDBLow 1.9
A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2.CVE-2026-19059 · Other software · FoundationAgents · reported by VulDBLow 1.9
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulation causes path traversal. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MetaGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.