Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
922 results · page 5 of 19
Apr 22, 2026An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service.CVE-2026-33257 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.3
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
- Product
- Authoritative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.powerdns.comdocs.powerdns.com
Apr 22, 2026An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service.CVE-2026-33256 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.3
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
- Product
- Recursor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticCVE-2026-6437 · Other software · Amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 6.9
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users should upgrade to version v3.0.1
- Product
- AWS EFS CSI Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Apr 17, 2026Unlimited Elements for Elementor: Arbitrary File ReadCVE-2026-4659 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Arbitrary File Read via the Repeater JSON/CSV URL parameter in versions up to, and including, 2.0.6. This is due to insufficient path traversal sanitization in the URLtoRelative() and urlToPath() functions, combined with the ability to enable debug output in widget settings. The URLtoRelative() function only performs a simple string replacement to remove the site's base URL without sanitizing path traversal sequences (../), and the cleanPath() function only normalizes directory separators without removing traversal components. This allows an attacker to provide a URL like http://site.com/../../../../etc/passwd which, after URLtoRelative() strips the domain, results in /../../../../etc/passwd being concatenated with the base path and ultimately resolved to /etc/passwd. This makes it possible for authenticated attackers with Author-level access and above to read arbitrary local files from the WordPress host, including sensitive files such as wp-config.
- Product
- Unlimited Elements for Elementor
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Unlimited Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 2026A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-level directories thaCVE-2026-35496 · Other software · CubeCart Limited · reported by vultures@jpcert.or.jpMedium 5.1
A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-level directories that should not be accessible.
- Product
- CubeCart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.cubecart.comjvn.jp
Apr 17, 2026An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product.CVE-2026-34018 · Other software · CubeCart Limited · reported by vultures@jpcert.or.jpMedium 5.1
An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product.
- Product
- CubeCart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.cubecart.comjvn.jp
Apr 17, 2026An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS commCVE-2026-21719 · Other software · CubeCart Limited · reported by vultures@jpcert.or.jpHigh 8.6
An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS command.
- Product
- CubeCart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.cubecart.comjvn.jp
Apr 14, 2026Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessions.CVE-2026-4914 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Medium 5.4
Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessions. User interaction is required.
- Product
- Neurons for ITSM (On-Premise)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows CVE-2026-2449 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fCritical 9
Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Hijacking a Privileged Thread of Execution.This issue affects upKeeper Instant Privilege Access: through 1.5.0.
- Product
- upKeeper Instant Privilege Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Boundary-unlimited vulnerability in the application read module.CVE-2026-34864 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
Boundary-unlimited vulnerability in the application read module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Apr 7, 2026During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.IntCVE-2026-32280 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
- Product
- crypto/x509
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2026Termite 3.4 contains a buffer overflow vulnerability in the User interface language settings field that allows local attackers to cause a denial of service by sCVE-2018-25253 · Other software · Compuphase · reported by VulnCheckMedium 6.9
Termite 3.4 contains a buffer overflow vulnerability in the User interface language settings field that allows local attackers to cause a denial of service by supplying an excessively long string. Attackers can paste a 2000-byte payload into the Settings User interface language field to crash the application.
- Product
- Termite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcompuphase.comcompuphase.com
Mar 31, 2026An arbitrary file overwrite vulnerability in RAREPROB SOLUTIONS PRIVATE LIMITED Video player Play All Videos v1.0.135 allows attackers to overwrite critical intCVE-2026-30280 · Other software · Rareprob · reported by MITREMedium 5.3
An arbitrary file overwrite vulnerability in RAREPROB SOLUTIONS PRIVATE LIMITED Video player Play All Videos v1.0.135 allows attackers to overwrite critical internal files via the file import process, leading to arbtrary code execution or information exposure.
- Product
- Video Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrareprob-website.firebaseapp.com
Mar 31, 2026An incorrect startup configuration of affected versions of Zscaler Client Connector on Windows may cause a limited amount of traffic from being inspected under CVE-2026-22569 · Other software · Zscaler · reported by cve@zscaler.comMedium 5.4
An incorrect startup configuration of affected versions of Zscaler Client Connector on Windows may cause a limited amount of traffic from being inspected under rare circumstances.
- Product
- Zscaler Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window whCVE-2026-5170 · Other software · MongoDB · reported by cna@mongodb.comMedium 6
A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set. This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Jupiter X Core: Limited file uploadsCVE-2026-3533 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on import_popup_templates() function as well as insufficient file type validation in the upload_files() function in all versions up to, and including, 4.14.1. This makes it possible for Authenticated attackers with Subscriber-level access and above, to upload files with dangerous types that can lead to Remote Code Execution on servers configured to handle .phar files as executable PHP (e.g., Apache+mod_php), or Stored Cross-Site Scripting via .svg, .dfxp, or .xhtml files upload on any server configuration
- Product
- Jupiter X Core
- Affected
- up to 4.14.1
- What to do
- Affects up to 4.14.1. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 23, 2026Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services PrCVE-2026-2298 · Other software · Salesforce · reported by security@salesforce.comCritical 9.4
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 30th, 2026.
- Product
- Marketing Cloud Engagement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Keep Backup Daily: Limited Path TraversalCVE-2026-3339 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_open_upload_dir` AJAX action. This is due to insufficient validation of the `kbd_path` parameter, which is only sanitized with `sanitize_text_field()` - a function that does not strip path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to list the contents of arbitrary directories on the server outside of the intended uploads directory.
- Product
- Keep Backup Daily
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Keep Backup Daily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 17, 2026An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.CVE-2026-4147 · Other software · MongoDB Inc · reported by cna@mongodb.comHigh 7.1
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Unlimited Elements for Elementor: Stored Cross-Site ScriptingCVE-2026-2724 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form entry fields in all versions up to, and including, 2.0.5. This is due to insufficient input sanitization and output escaping on form submission data displayed in the admin Form Entries Trash view. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the trashed form entries.
- Product
- Unlimited Elements for Elementor
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Unlimited Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 10, 2026An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeceptor 6.0 all versiCVE-2026-25689 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6.5
An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeceptor 6.0 all versions, FortiDeceptor 5.3 all versions, FortiDeceptor 5.2 all versions, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions, FortiDeceptor 4.3 all versions, FortiDeceptor 4.2 all versions, FortiDeceptor 4.1 all versions, FortiDeceptor 4.0 all versions may allow a privileged attacker with super-admin profile and CLI access to delete sensitive files via crafted HTTP requests.
- Product
- FortiDeceptor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Mar 10, 2026Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction required.CVE-2025-69615 · Other software · Telekom · reported by MITRECritical 9.1
Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction required. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-24, fixed 2025-11-03.
- Product
- Account Management Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comtelekom.com
Mar 10, 2026An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access.CVE-2025-41711 · Other software · Janitza · reported by info@cert.vde.comMedium 5.3
An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access.
- Product
- UMG 96RM-E 24V(5222063)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Mar 10, 2026An unauthenticated remote attacker may use hardcodes credentials to get access to the previously activated FTP Server with limited read and write privileges.CVE-2025-41710 · Other software · Janitza · reported by info@cert.vde.comMedium 6.5
An unauthenticated remote attacker may use hardcodes credentials to get access to the previously activated FTP Server with limited read and write privileges.
- Product
- UMG 96RM-E 24V(5222063)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Mar 3, 2026A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem integrity check and maintain limited persistence via a maliCVE-2026-3344 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 6.9
A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem integrity check and maintain limited persistence via a maliciously-crafted firmware update package.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.watchguard.comwatchguard.com
Mar 2, 2026Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command CentreCVE-2026-20757 · Other software · Gallagher · reported by disclosures@gallagher.comLow 2.5
Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server. This issue affects Command Centre Server: 9.40 prior to vEL9.40.1976(MR1), 9.30 prior to vEL9.30.3382 (MR4), 9.20 prior to vEL9.20.3783 (MR6), 9.10 prior to vEL9.10.4647 (MR9), all versions of 9.00 and prior.
- Product
- Command Centre Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.com
Mar 2, 2026In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps withoutCVE-2026-0005 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.2
In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps without knowing the LSKF due to a missing permission check. This could lead to local information disclosure where the extent of interaction and impact is app-dependent with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain an authentication bypass vulnerability that allows remote attackers to perform unlimited logiCVE-2026-27753 · Other software · Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks) · reported by VulnCheckMedium 6.9
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain an authentication bypass vulnerability that allows remote attackers to perform unlimited login attempts against the management interface. Attackers can conduct online password guessing attacks without account lockout or rate limiting restrictions to gain unauthorized access to the device management interface.
- Product
- SODOLA SL902-SWTGW124AS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsodola-network.comvulncheck.com
Feb 25, 2026zae-limiter is a rate limiting library using the token bucket algorithm.CVE-2026-27695 · Other software · zeroae · reported by GitHubMedium 4.3
zae-limiter is a rate limiting library using the token bucket algorithm. Prior to version 0.10.1, all rate limit buckets for a single entity share the same DynamoDB partition key (`namespace/ENTITY#{id}`). A high-traffic entity can exceed DynamoDB's per-partition throughput limits (~1,000 WCU/sec), causing throttling that degrades service for that entity — and potentially co-located entities in the same partition. Version 0.10.1 fixes the issue.
- Product
- zae-limiter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026The web management interface of the device renders the passwords in a plaintext input field.CVE-2026-26049 · Other software · Jinan USR IOT Technology Limited (PUSR) · reported by ics-cert@hq.dhs.govMedium 5.7
The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access to the UI, potentially exposing administrator credentials to unauthorized observation via shoulder surfing, screenshots, or browser form caching.
- Product
- USR-W610
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026The Wi-Fi router is vulnerable to de-authentication attacks due to the absence of management frame protection, allowing forged deauthentication and disassociaCVE-2026-26048 · Other software · Jinan USR IOT Technology Limited (PUSR) · reported by ics-cert@hq.dhs.govHigh 7.5
The Wi-Fi router is vulnerable to de-authentication attacks due to the absence of management frame protection, allowing forged deauthentication and disassociation frames to be broadcast without authentication or encryption. An attacker can use this to cause unauthorized disruptions and create a denial-of-service condition.
- Product
- USR-W610
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026The web management interface of the device allows the administrator username and password to be set to blank values.CVE-2026-25715 · Other software · Jinan USR IOT Technology Limited (PUSR) · reported by ics-cert@hq.dhs.govCritical 9.8
The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet service. This effectively disables authentication across all critical management channels, allowing any network-adjacent attacker to gain full administrative control without credentials.
- Product
- USR-W610
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026The embedded web interface of the device does not support HTTPS/TLS for authentication and uses HTTP Basic Authentication.CVE-2026-24455 · Other software · Jinan USR IOT Technology Limited (PUSR) · reported by ics-cert@hq.dhs.govHigh 7.5
The embedded web interface of the device does not support HTTPS/TLS for authentication and uses HTTP Basic Authentication. Traffic is encoded but not encrypted, exposing user credentials to passive interception by attackers on the same network.
- Product
- USR-W610
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Checkout Field Manager (Checkout Manager) for WooCommerce: Unauthenticated limited file uploadCVE-2025-12500 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to unauthenticated limited file upload in all versions up to, and including, 7.8.1. This is due to the plugin not properly verifying that a user is authorized to perform file upload actions via the "ajax_checkout_attachment_upload" function. This makes it possible for unauthenticated attackers to upload files to the server, though file types are limited to WordPress's default allowed MIME types (images, documents, etc.).
- Product
- Checkout Field Manager (Checkout Manager) for WooCommerce
- Affected
- up to 7.8.1
- What to do
- Affects up to 7.8.1. Update Checkout Field Manager (Checkout Manager) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 17, 2026IBM watsonx.data 2.2 through 2.2.1 IBM Lakehouse could allow a privileged user to upload malicious files that could be executed server to modify limited files oCVE-2025-36183 · Other software · IBM · reported by psirt@us.ibm.comLow 3.8
IBM watsonx.data 2.2 through 2.2.1 IBM Lakehouse could allow a privileged user to upload malicious files that could be executed server to modify limited files or data.
- Product
- watsonx.data
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access toCVE-2026-22922 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Feb 5, 2026Robin Image Optimizer – Unlimited Image Optimization & WebP Converter: Stored Cross-Site ScriptingCVE-2026-1319 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Robin Image Optimizer – Unlimited Image Optimization & WebP Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of a Media Library image in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Robin Image Optimizer – Unlimited Image Optimization & WebP Converter
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Robin Image Optimizer – Unlimited Image Optimization & WebP Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 3, 2026VPN Unlimited 6.1 contains an unquoted service path vulnerability that allows local attackers to inject malicious executables into the service binary path.CVE-2020-37101 · Other software · Vpnunlimitedapp · reported by VulnCheckHigh 8.5
VPN Unlimited 6.1 contains an unquoted service path vulnerability that allows local attackers to inject malicious executables into the service binary path. Attackers can exploit the unquoted path in 'C:\Program Files (x86)\VPN Unlimited\' to replace the service executable and gain elevated system privileges.
- Product
- VPN unlimited
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvpnunlimitedapp.com
Feb 3, 2026Unlimited Elements for Elementor: Stored Cross-Site ScriptingCVE-2025-14274 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Border Hero widget's Button Link field in versions up to 2.0.1. This is due to insufficient input sanitization and output escaping on user-supplied URLs. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Unlimited Elements for Elementor
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Unlimited Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 2, 2026IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 may expose a limited amount of data to a peer parCVE-2025-36194 · Other software · IBM · reported by psirt@us.ibm.comLow 2.8
IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 may expose a limited amount of data to a peer partition in specific shared processor configurations during certain operations.
- Product
- PowerVM Hypervisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module)CVE-2026-22583 · Other software · Salesforce · reported by security@salesforce.comCritical 9.8
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
- Product
- Marketing Cloud Engagement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) CVE-2026-22582 · Other software · Salesforce · reported by security@salesforce.comCritical 9.8
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
- Product
- Marketing Cloud Engagement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026A vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could allow an unauthenticatCVE-2025-67823 · Email & office · Mitel · reported by MITREHigh 8.2
A vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could allow an unauthenticated attacker to conduct a Cross-Site Scripting (XSS) attack due to insufficient input validation. A successful exploit requires user interaction where the email channel is enabled. This could allow an attacker to execute arbitrary scripts in the victim's browser or desktop client application.
- Product
- CX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an unauthenticated attacCVE-2025-67822 · Email & office · Mitel · reported by MITRECritical 9.4
A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an unauthenticated attacker to conduct an authentication bypass attack due to improper authentication mechanisms. A successful exploit could allow an attacker to gain unauthorized access to user or admin accounts in the system.
- Product
- Mivoice Mx-one
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manipulation.CVE-2026-22914 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manipulation.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impacCVE-2025-67858 · Other software · https://github.com/FoobarOy/ · reported by meissner@suse.deHigh 7
A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to `nft`. This issue affects Foomuuri: from ? before 0.31.
- Product
- Foomuuri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comsecurity.opensuse.org
Jan 8, 2026An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability allows local users ton perform arbitrary unmounts via smb4kCVE-2025-66002 · Other software · https://github.com/KDE/ · reported by meissner@suse.deMedium 6.9
An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability allows local users ton perform arbitrary unmounts via smb4k mount helper
- Product
- smb4k
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comsecurity.opensuse.org
Jan 8, 2026Mitech: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22708 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Mitech mitech allows PHP Local File Inclusion.This issue affects Mitech: from n/a through <= 2.3.4.
- Product
- Mitech
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update Mitech to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2026Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: Unauthorized Arbitrary Media ReplacementCVE-2025-12640 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Replacement in all versions up to, and including, 3.1.5. This is due to missing object-level authorization checks in the handle_folders_file_upload() function. This makes it possible for authenticated attackers, with Author-level access and above, to replace arbitrary media files from the WordPress Media Library.
- Product
- Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2026An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories.CVE-2025-66620 · Other software · Columbia Weather Systems · reported by ics-cert@hq.dhs.govHigh 8.6
An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories. An attacker with admin access to MicroServer can gain limited shell access, enabling persistence through reverse shells, and the ability to modify or remove data stored in the file system.
- Product
- MicroServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.