Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18,484 results · page 5 of 370
Oct 15, 2026MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documCVE-2026-111364 · Other software · mindoc-org · reported by VulnCheckHigh 7.1
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.
- Product
- MinDoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parseCVE-2026-111363 · Other software · dataelement · reported by VulnCheckHigh 7.1
BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.
- Product
- bisheng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' oCVE-2026-111359 · Other software · crmeb · reported by VulnCheckHigh 7.1
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.
- Product
- CRMEB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by CVE-2026-111355 · Other software · zhontai · reported by VulnCheckMedium 5.3
zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments.
- Product
- Admin.Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other usersCVE-2026-111353 · Other software · Peppermint-Lab · reported by VulnCheckMedium 5.3
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.
- Product
- peppermint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypCVE-2026-111351 · Other software · metasfresh · reported by VulnCheckLow 2.3
metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.
- Product
- metasfresh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams'CVE-2026-111350 · Other software · papermark · reported by VulnCheckLow 2.3
Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group links, or rewrite group document permissions across teams.
- Product
- Papermark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access oCVE-2026-111348 · Other software · likeshop · reported by VulnCheckMedium 5.3
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.
- Product
- likeshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users'CVE-2026-111346 · Other software · easysoft · reported by VulnCheckMedium 5.3
ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.
- Product
- zentaopms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplCVE-2026-111344 · Other software · apitable · reported by VulnCheckMedium 5.3
APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/{nodeId}/description, which skips space membership and node permission checks, to disclose cross-tenant datasheet, folder, and form descriptions.
- Product
- apitable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via CVE-2026-111343 · Other software · pig-mesh · reported by VulnCheckMedium 5.3
pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.
- Product
- pig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthCVE-2026-111313 · Other software · DaKheera47 · reported by VulnCheckHigh 7.1
JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.
- Product
- JobOps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescapCVE-2026-111284 · Other software · Webkul · reported by VulnCheckMedium 5.1
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.
- Product
- Aureus ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.systemCVE-2026-106700 · Other software · reported by MITREHigh 8.8
ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs no role-level or ownership validation in UserServiceImpl.resetPwd. Any authenticated user of any role can reset the password of arbitrary users, including the built-in administrator.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port FoCVE-2026-111232 · Other software · Netgate · reported by VulnCheckMedium 4.8
Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore(CVE-2026-111231 · Other software · Netgate · reported by VulnCheckHigh 8.6
Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by settiCVE-2026-111230 · Other software · Netgate · reported by VulnCheckMedium 6.9
Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HACVE-2026-111229 · Other software · Netgate · reported by VulnCheckHigh 8.6
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS ReCVE-2026-111228 · Other software · Netgate · reported by VulnCheckMedium 5.1
Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: AccCVE-2026-111227 · Other software · Netgate · reported by VulnCheckMedium 5.1
Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access_lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to exeCVE-2026-111226 · Other software · Netgate · reported by VulnCheckHigh 8.6
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to exCVE-2026-111224 · Other software · Netgate · reported by VulnCheckHigh 7.7
pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute CVE-2026-111223 · Other software · Netgate · reported by VulnCheckHigh 8.6
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techabraxaslabs.tech
Oct 15, 2026Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives bCVE-2026-111222 · Other software · Netgate · reported by VulnCheckHigh 7.5
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting aCVE-2026-111221 · Other software · Netgate · reported by VulnCheckHigh 7.5
Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by iCVE-2026-111220 · Other software · Netgate · reported by VulnCheckHigh 8.6
pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entriesCVE-2026-111219 · Other software · Netgate · reported by VulnCheckHigh 7.5
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges toCVE-2026-111218 · Other software · Netgate · reported by VulnCheckHigh 8.6
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techabraxaslabs.tech
Oct 15, 2026Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commaCVE-2026-111217 · Other software · Netgate · reported by VulnCheckHigh 8.6
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techabraxaslabs.tech
Oct 15, 2026Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commandsCVE-2026-111216 · Other software · Netgate · reported by VulnCheckHigh 8.6
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a craftCVE-2026-111215 · Other software · Netgate · reported by VulnCheckHigh 8.6
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 15, 2026Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands bCVE-2026-111214 · Other software · Netgate · reported by VulnCheckHigh 8.6
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.
- Product
- pfSense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techabraxaslabs.tech
Oct 15, 2026La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannCVE-2026-111169 · Other software · suitenumerique · reported by VulnCheckLow 2.3
La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.
- Product
- docs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type andCVE-2026-110878 · Other software · aureuserp · reported by VulnCheckMedium 5.1
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse managers or administrators view or edit Inventory Rules, performing actions in their session context.
- Product
- aureuserp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falCVE-2026-102631 · Other software · Canonical · reported by security@ubuntu.comMedium 5.9
In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provider ID. If an identity provider reassigns an email address, which authd uses as the username, to a new account, the new account inherits the previous user's local UID and home directory on its next login. This allows the new user to access and modify files belonging to the previous user, including credentials such as SSH keys and cloud API tokens, and silently rebinds the local account record to the new identity. As a mitigation, administrators should lock or delete the previous user's local authd account when the corresponding IdP account is removed.
- Product
- authd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netgithub.com
Oct 15, 2026A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.CVE-2026-105474 · Other software · WebPros · reported by support@hackerone.comCritical 9.4
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
- Product
- SolusVM 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connectedCVE-2026-103509 · Other software · Perforce · reported by security@puppet.comHigh 8.5
P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3.
- Product
- P4 (Helix core)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Import and export users and customers: Stored Cross-Site ScriptingCVE-2026-17001 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Import and export users and customers
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 14, 2026Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadraticCVE-2026-110871 · Other software · nodemailer · reported by VulnCheckHigh 7.1
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.
- Product
- nodemailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 14, 2026Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs viCVE-2026-110868 · Other software · renovatebot · reported by VulnCheckHigh 8.4
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.
- Product
- renovate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 14, 2026Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules heaCVE-2026-110865 · Other software · renovatebot · reported by VulnCheckHigh 7.1
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.
- Product
- renovate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 14, 2026Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other usCVE-2026-110863 · Other software · better-auth · reported by VulnCheckHigh 8.6
Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.
- Product
- sso
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 14, 2026Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by rCVE-2026-110862 · Other software · better-auth · reported by VulnCheckCritical 9.3
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.
- Product
- better-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 14, 2026Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base fCVE-2026-110775 · Other software · ModelEngine-Group · reported by VulnCheckHigh 7.1
Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.
- Product
- nexent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachmeCVE-2026-110774 · Other software · blinkospace · reported by VulnCheckMedium 6
Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp pattern, to download private, non-shared attachments.
- Product
- blinko
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all orCVE-2026-110773 · Other software · growchief · reported by VulnCheckMedium 5.3
GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short search value to GET /users/all-users to enumerate user ids, emails, names and organization IDs of every tenant.
- Product
- growchief
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded travCVE-2026-110766 · Other software · colanode · reported by VulnCheckMedium 5.3
Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.
- Product
- colanode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deseCVE-2026-110761 · Other software · ILIAS-eLearning e.V. · reported by VulnCheckHigh 8.7
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.
- Product
- ILIAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocu.ilias.dedocu.ilias.de
Oct 14, 2026Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users.CVE-2026-67577 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Medium 4.3
Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity can include repository names, commit messages, and issue or pull request events associated with qualifying public-repository activity.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 14, 2026Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts.CVE-2026-66849 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Medium 4.3
Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects user-owned package registries and exposes package contents across the intended authorization boundary.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.