Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,323 results · page 5 of 47
Sep 11, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perfoCVE-2026-77490 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.CVE-2026-70341 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.5
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026YITH WooCommerce Waitlist Premium: Privilege EscalationCVE-2026-14359 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action being missing both a capability check and a nonce verification, and using parse_str() + extract() to import attacker-controlled variables from $_POST['params'] that are then passed to wp_create_user() and $user->set_role(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator by creating a new user account and assigning it the administrator role.
- Product
- YITH WooCommerce Waitlist Premium
- Affected
- up to 3.35.0
- What to do
- Affects up to 3.35.0. Update YITH WooCommerce Waitlist Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comyithemes.com
Sep 8, 2026Tanium addressed an unauthorized code execution vulnerability in Enforce.CVE-2026-87088 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7
Tanium addressed an unauthorized code execution vulnerability in Enforce.
- Product
- Enforce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed a server-side request forgery vulnerability in Enforce.CVE-2026-87084 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.7
Tanium addressed a server-side request forgery vulnerability in Enforce.
- Product
- Enforce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-87075 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 8.1
Tanium addressed an improper access controls vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-87073 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed an improper access controls vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-87072 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.1
Tanium addressed an improper access controls vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-87048 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 5.4
Tanium addressed an improper access controls vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-87047 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.3
Tanium addressed an improper access controls vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-87046 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.3
Tanium addressed an improper access controls vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-87037 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 5.4
Tanium addressed an improper access controls vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-87036 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 8.1
Tanium addressed an improper access controls vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed an information disclosure vulnerability in Comply.CVE-2026-87035 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.3
Tanium addressed an information disclosure vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed a SQL injection vulnerability in Comply.CVE-2026-87034 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 8.3
Tanium addressed a SQL injection vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-87033 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 5.4
Tanium addressed an improper access controls vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed an information disclosure vulnerability in Tanium Server.CVE-2026-87032 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.3
Tanium addressed an information disclosure vulnerability in Tanium Server.
- Product
- Tanium Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed a path traversal vulnerability in Comply.CVE-2026-87030 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 8.5
Tanium addressed a path traversal vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-87025 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 5.4
Tanium addressed an improper access controls vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed a path traversal vulnerability in Comply.CVE-2026-87023 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 8.5
Tanium addressed a path traversal vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed an unauthorized code execution vulnerability in Comply.CVE-2026-87021 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.2
Tanium addressed an unauthorized code execution vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-87019 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.3
Tanium addressed an improper access controls vulnerability in Comply.
- Product
- Comply
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed an improper access controls vulnerability in Tanium Server.CVE-2026-14892 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.3
Tanium addressed an improper access controls vulnerability in Tanium Server.
- Product
- Tanium Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Tanium addressed a path traversal vulnerability in Tanium Data Service.CVE-2026-14505 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.6
Tanium addressed a path traversal vulnerability in Tanium Data Service.
- Product
- Tanium Data Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox vCVE-2026-87585 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 8, 2026Improper input validation in Chromium in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI eleCVE-2026-87568 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Improper input validation in Chromium in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via crafted network traffic. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 8, 2026Google Chromium V8 Out of Bounds Write VulnerabilityCVE-2026-87491 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Product
- Chromium V8
- On CISA’s list since
- Sep 9, 2026 (federal fix deadline Sep 23, 2026)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comissues.chromium.org
Sep 3, 2026Google Chromium V8 Type Confusion VulnerabilityCVE-2026-85046 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Product
- Chromium V8
- On CISA’s list since
- Sep 4, 2026 (federal fix deadline Sep 18, 2026)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comissues.chromium.org
Sep 3, 2026Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.CVE-2026-84238 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 2, 2026Yoast SEO Premium: Does not sanitize control characters from redirect origins before writing them to the site's Apache configuration fileCVE-2026-10821 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.
- Product
- Yoast SEO Premium
- Fixed in
- 27.6.1
- What to do
- Update Yoast SEO Premium to 27.6.1 or newer.
Sep 2, 2026Booking for Appointments and Events Calendar – Amelia (Premium): Privilege EscalationCVE-2026-9055 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when the 'externalId' parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a provider entity linked to an administrator user ID and overwriting that administrator's password.
- Product
- Booking for Appointments and Events Calendar – Amelia (Premium)
- Affected
- 8.0 to 9.6.2
- What to do
- Affects 8.0 to 9.6.2. Update Booking for Appointments and Events Calendar – Amelia (Premium) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpamelia.comwordfence.com
Sep 1, 2026appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools, allowing attackers to write files outsCVE-2026-84201 · Other software · argneshu · reported by VulnCheckMedium 6.9
appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools, allowing attackers to write files outside the intended PROJECT_ROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite arbitrary files with the server user's privileges, including shell profiles and configuration files in the home directory.
- Product
- appium-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026WP Recipe Maker Premium: Stored Cross-Site ScriptingCVE-2026-7877 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions up to, and including, 10.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Recipe Maker Premium
- Affected
- up to 10.5.0
- What to do
- Affects up to 10.5.0. Update WP Recipe Maker Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordhelp.bootstrapped.ventureswordfence.com
Aug 31, 2026A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11.CVE-2026-82971 · Other software · QVidium · reported by VulDBCritical 9.3
A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains: "QVidium has now closed its doors and no longer will be able to sell products or provide support." This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Opera11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorduvxbywu62qm.feishu.cnvuldb.com
Aug 28, 2026Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-72984 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.CVE-2026-70331 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-70309 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-66798 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.CVE-2026-66324 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-66323 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.CVE-2026-62904 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to diCVE-2026-58616 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.4
Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to disclose information over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Trilium is an open-source hierarchical note-taking application.CVE-2026-77438 · Other software · TriliumNext · reported by GitHubHigh 7.5
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and content of protected shared notes. The endpoint authorizes only the ancestor note supplied in the request and then runs a full-text search across the entire published subtree, returning each matching note's title, share identifier, and hierarchical path without re-checking whether that individual note requires a share password or is hidden from the navigation tree. Because the search matches note content, an attacker can enumerate protected notes and use the endpoint as a boolean oracle that confirms arbitrary substrings, recovering the full contents of notes that should be gated behind a password. This issue is fixed in version 0.104.0.
- Product
- Trilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Trilium is an open-source hierarchical note-taking application.CVE-2026-53580 · Other software · TriliumNext · reported by GitHubHigh 8.1
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files readable by the Trilium process. When a text note is saved, Trilium scans its HTML for image sources and downloads each external one; because the HTML sanitizer keeps file as an allowed scheme, a source such as file:///etc/passwd is passed straight to a filesystem read and its contents are stored as a note attachment the user can then retrieve. Pointing the same primitive at an unbounded source such as /dev/zero causes uncontrolled memory allocation that crashes the server process. The feature is enabled by default and is reachable through the web UI, the ETAPI, the web clipper, and note imports, requiring only an authenticated session or an ETAPI token. This issue is fixed in version 0.104.0
- Product
- Trilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Trilium is an open-source hierarchical note-taking application.CVE-2026-53579 · Other software · TriliumNext · reported by GitHubCritical 9.3
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an attacker-supplied import archive to embed a payload that executes as script. A book note's content is routed through the same rendering path as text notes and injected into the page with jQuery's html method when the note is shown as a grid-view preview card, so a malicious note survives Safe import and runs as soon as the victim opens the containing note. On the desktop client the Electron renderer runs with Node integration enabled, so the injected JavaScript escalates from cross-site scripting to full remote code execution on the victim's machine. This issue is fixed in version 0.104.0.
- Product
- Trilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Trilium is an open-source hierarchical note-taking application.CVE-2026-53578 · Other software · TriliumNext · reported by GitHubCritical 9.3
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the mindMap note type, whose JSON content is stored without sanitization, allowing an attacker-supplied import archive to embed a payload that renders as arbitrary HTML. A mind map node can carry a dangerouslySetInnerHTML property that the Mind Elixir library assigns directly to a node's innerHTML, so a malicious note survives Safe import and executes script as soon as the victim opens the imported mind map. On the desktop client the Electron renderer runs with Node integration enabled, so the injected JavaScript escalates from cross-site scripting to full remote code execution on the victim's machine. This issue is fixed in version 0.104.0.
- Product
- Trilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Trilium is an open-source hierarchical note-taking application.CVE-2026-48996 · Other software · TriliumNext · reported by GitHubCritical 9.3
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an attacker-supplied import archive to inject script that runs when the map is displayed. Because Safe import neutralizes scripts but never escapes titles, a note whose title contains an HTML event-handler payload survives the import and executes as soon as the victim opens the GeoMap that renders its marker. On the desktop client the Electron renderer runs with Node integration enabled, so the injected JavaScript escalates from cross-site scripting to full remote code execution on the victim's machine. This issue is fixed in version 0.104.0.
- Product
- Trilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Trilium is an open-source hierarchical note-taking application.CVE-2026-47727 · Other software · TriliumNext · reported by GitHubHigh 8.6
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side template that leads to remote code execution. The relation is omitted from the built-in list of dangerous attributes, so unlike other code-loading relations it is not disabled on import, and when the victim later publishes the imported note the public share renderer feeds the linked EJS code note's raw bytes into ejs.render, which compiles them in the server's Node process. An unauthenticated request to the shared note then executes the attacker's JavaScript with full access to require, process, the filesystem, and the network. This issue is fixed in version 0.104.0.
- Product
- Trilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted file.CVE-2026-79223 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted file. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Incomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via aCVE-2026-78947 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Incomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.