Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,493 results · page 5 of 30
May 26, 2026Algernon is a small self-contained pure-Go web server.CVE-2026-45728 · Other software · xyproto · reported by GitHubHigh 7.5
Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, which on any Lua or template error response dumps the absolute path of the file that errored, complete byte contents of that file, and exception or parser error text. This response is served with HTTP 200 OK to whoever sent the request that triggered the error. Any client able to reach the server and able to provoke a runtime error in the served script obtains the full server-side source of that script and of any sibling Lua data file consulted during the request. This vulnerability is fixed in 1.17.7.
- Product
- algernon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Algernon is a small self-contained pure-Go web server.CVE-2026-45721 · Other software · xyproto · reported by GitHubCritical 9
Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories — past the configured server root — looking for a file named handler.lua to execute as the request handler. The loop terminates only after 100 ancestor steps or when filepath.Dir returns ., so on any absolute server-root path the search reaches the filesystem root (/ on Unix, drive letter on Windows). The first handler.lua it finds is loaded into the Lua interpreter with the full Algernon API exposed — including run3(), httpclient, os.execute, io.popen, PQ, MSSQL, raw filesystem access, and the userstate database. Any process that can write handler.lua anywhere in a parent directory of the server root obtains pre-authenticated remote code execution on the next HTTP request. This is reachable without authentication — the lookup happens before the permission check returns a hit (the perm system only gates URL prefixes, not the handler-resolution step), and any URL pointing at a directory without an index triggers the walk. On a fresh stock Algernon install the request GET / i
- Product
- algernon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Algernon is a small self-contained pure-Go web server.CVE-2026-43982 · Other software · xyproto · reported by GitHubHigh 8.7
Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn() in lua/upload/upload.go uses filepath.Join() with the caller-supplied directory but performs no boundary check after joining. A directory of ../../../tmp resolves cleanly to /tmp, outside the web root. This vulnerability is fixed in 1.17.6.
- Product
- algernon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Algernon is a small self-contained pure-Go web server.CVE-2026-43981 · Other software · xyproto · reported by GitHubHigh 8.2
Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, in engine/luahandler.go, the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute. Since gopher-lua's LState is explicitly not goroutine-safe, concurrent requests race on the shared state causing Lua VM corruption. The Go race detector confirms this immediately under modest concurrency (ab -n 1000 -c 100). This vulnerability is fixed in 1.17.6.
- Product
- algernon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receiveCVE-2026-8706 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
May 17, 2026Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries bCVE-2018-25333 · Other software · nordex-online · reported by VulnCheckHigh 8.8
Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the login parameter in login.php. Attackers can submit crafted POST requests with SQL injection payloads in the login field to extract sensitive database information and bypass authentication mechanisms.
- Product
- N149 Wind Turbine Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnordex-online.comexploit-db.com
May 12, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-44015 · Other software · 0xJacky · reported by GitHubHigh 8.5
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /actionCVE-2026-36356 · Other software · reported by MITRECritical 9.1
The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /action/SetRemoteAccessCfg endpoint.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-42238 · Other software · 0xJacky · reported by GitHubCritical 9
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/restore) that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can upload a crafted backup archive that overwrites the application's configuration file (app.ini) and SQLite database. Because the attacker controls the restored app.ini, they can inject an arbitrary OS command into the TestConfigCmd setting. After the application automatically restarts to apply the restored config, a single follow-up request triggers that command as the user running nginx-ui — typically root in Docker deployments. This issue has been patched in version 2.3.8.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-42223 · Other software · 0xJacky · reported by GitHubMedium 6.5
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-65) serializes all settings structs to JSON and returns them to authenticated users. Many sensitive fields are tagged with protected:"true" - however, this tag is only enforced during writes (via ProtectedFill in SaveSettings) and is completely ignored during reads. This exposes 40+ protected fields including JwtSecret (enabling auth token forgery), NodeSecret (enabling cluster node impersonation), OIDC ClientSecret (enabling OAuth account takeover), and the IP whitelist configuration. This issue has been patched in version 2.3.8.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-42222 · Other software · 0xJacky · reported by GitHubHigh 8.1
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-42221 · Other software · 0xJacky · reported by GitHubHigh 8.1
Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint is reachable without authentication, and the request-encryption flow only protects payload confidentiality in transit; it does not authenticate who is allowed to perform installation. A remote attacker who reaches the service before the legitimate operator can set the admin email, username, and password, causing permanent initial-instance takeover. This issue has been patched in version 2.3.8.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-42220 · Other software · 0xJacky · reported by GitHubMedium 6.5
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret header (or node_secret query parameter), causing the request to be treated as authenticated via the trusted-node path and associated with the init user. This issue has been patched in version 2.3.8.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 is vulnerable to Denial of Service via the boa web server URI handler.CVE-2026-36957 · Other software · Dbitnet · reported by MITREHigh 7.5
Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 is vulnerable to Denial of Service via the boa web server URI handler. By initiating a high-volume flood of HTTP GET requests to non-existent URIs, an attacker can exhaust critical system resources, including file descriptors and memory buffers. This results in a kernel deadlock or system hang that disables the web management portal and all routing capabilities.
- Product
- Dbit N300 T1 Pro Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026Penetration Testing engineers at Amazon have identified a security flaw related to request handling in the web server component that could, under certain conditCVE-2024-54013 · Other software · Hanwha Vision · reported by fc9afe74-3f80-4fb7-a313-e6f036a89882High 8.7
Penetration Testing engineers at Amazon have identified a security flaw related to request handling in the web server component that could, under certain conditions, lead to unintended access to protected functions. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds
- Product
- QND-8080R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras.CVE-2026-32649 · Other software · Milesight · reported by ics-cert@hq.dhs.govHigh 7.3
A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras.
- Product
- MS-Cxx63-PD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access functionality.CVE-2026-6903 · Other software · Zurich Instruments · reported by vulnerability@ncsc.chHigh 8.7
The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access functionality. An unauthenticated attacker could exploit this vulnerability to read arbitrary files on the host system that are accessible to the operating system user running the LabOne software. Additionally, the Web Server does not sufficiently restrict cross-origin requests, which could allow a remote attacker to trigger file access from a victim's browser by directing the victim to a malicious website. The vulnerability is only exploitable when the LabOne Web Server is running. Installations using only the LabOne APIs without starting the Web Server are not exposed.
- Product
- LabOne
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service.CVE-2026-33260 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.3
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
- Product
- Authoritative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.powerdns.comdocs.powerdns.com
Apr 22, 2026An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service.CVE-2026-33257 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.3
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
- Product
- Authoritative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.powerdns.comdocs.powerdns.com
Apr 22, 2026An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service.CVE-2026-33256 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.3
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
- Product
- Recursor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made.CVE-2025-13826 · Other software · Zervit · reported by cve-coordination@incibe.esHigh 8.2
Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate validation of user-supplied input. An attacker can exploit this vulnerability by sending malicious requests. If the vulnerability is successfully exploited, the application can be made to stop responding, resulting in a DoS condition. It is possible to manually restart the application.
- Product
- portable HTTP/Web server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-34403 · Other software · 0xJacky · reported by GitHubMedium 5.5
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combined with the fact that authentication tokens are stored in browser cookies (set via JavaScript without HttpOnly or explicit SameSite attributes), a malicious webpage can establish authenticated WebSocket connections to the nginx-ui instance when a logged-in administrator visits the attacker-controlled page. Version 2.3.5 patches the issue.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33031 · Other software · 0xJacky · reported by GitHubHigh 8.6
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate that user’s access, so an attacker who already stole a JWT can continue reading and modifying protected resources after the account is marked disabled. Since tokens can be used to create new accounts, it is possible the disabled user to maintain the privilege. Version 2.3.4 patches the issue.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026HiSecOS web server versions 03.4.00 prior to 04.1.00 contains a privilege escalation vulnerability that allows authenticated users with operator or auditor roleCVE-2023-7342 · Other software · Belden · reported by VulnCheckHigh 8.7
HiSecOS web server versions 03.4.00 prior to 04.1.00 contains a privilege escalation vulnerability that allows authenticated users with operator or auditor roles to escalate privileges to the administrator role by sending specially crafted packets to the web server. Attackers can exploit this flaw to gain full administrative access to the affected device.
- Product
- Hirschmann HiSecOS EAGLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.belden.comvulncheck.com
Apr 2, 2026Rack is a modular Ruby web server interface.CVE-2026-34835 · Other software · rack · reported by GitHubMedium 4.8
Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, #, and @. Because req.host returns the full parsed value, applications that validate hosts using naive prefix or suffix checks can be bypassed. This can lead to host header poisoning in applications that use req.host, req.url, or req.base_url for link generation, redirects, or origin validation. This issue has been patched in versions 3.1.21 and 3.2.6.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Rack is a modular Ruby web server interface.CVE-2026-34827 · Other software · rack · reported by GitHubHigh 7.5
Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mime_head parses quoted multipart parameters such as Content-Disposition: form-data; name="..." using repeated String#index searches combined with String#slice! prefix deletion. For escape-heavy quoted values, this causes super-linear processing. An unauthenticated attacker can send a crafted multipart/form-data request containing many parts with long backslash-escaped parameter values to trigger excessive CPU usage during multipart parsing. This results in a denial of service condition in Rack applications that accept multipart form data. This issue has been patched in versions 3.1.21 and 3.2.6.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Apr 2, 2026ewe is a Gleam web server.CVE-2026-34715 · Other software · vshakitskiy · reported by GitHubMedium 5.3
ewe is a Gleam web server. Prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF (\r\n) sequences. An application that passes user-controlled data into response headers (e.g., setting a Location redirect header from a request parameter) allows an attacker to inject arbitrary HTTP response content, leading to response splitting, cache poisoning, and possible cross-site scripting. Notably, ewe does validate CRLF in incoming request headers via validate_field_value() in the HTTP/1.1 parser — but provides no equivalent protection for outgoing response headers in the encoder. This issue has been patched in version 3.0.6.
- Product
- ewe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Rack is a modular Ruby web server interface.CVE-2026-32762 · Other software · rack · reported by GitHubMedium 4.8
Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack::Utils.forwarded_values parses the RFC 7239 Forwarded header by splitting on semicolons before handling quoted-string values. Because quoted values may legally contain semicolons, a header can be interpreted by Rack as multiple Forwarded directives rather than as a single quoted for value. In deployments where an upstream proxy, WAF, or intermediary validates or preserves quoted Forwarded values differently, this discrepancy can allow an attacker to smuggle host, proto, for, or by parameters through a single header value. This issue has been patched in versions 3.1.21 and 3.2.6.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Rack is a modular Ruby web server interface.CVE-2026-26962 · Other software · rack · reported by GitHubMedium 4.8
Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds folded multipart part headers incorrectly. When a multipart header contains an obs-fold sequence, Rack preserves the embedded CRLF in parsed parameter values such as filename or name instead of removing the folded line break during unfolding. As a result, applications that later reuse those parsed values in HTTP response headers may be vulnerable to downstream header injection or response splitting. This issue has been patched in version 3.2.6.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Rack is a modular Ruby web server interface.CVE-2026-34831 · Other software · rack · reported by GitHubMedium 4.8
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail sets the Content-Length response header using String#size instead of String#bytesize. When the response body contains multibyte UTF-8 characters, the declared Content-Length is smaller than the number of bytes actually sent on the wire. Because Rack::Files reflects the requested path in 404 responses, an attacker can trigger this mismatch by requesting a non-existent path containing percent-encoded UTF-8 characters. This results in incorrect HTTP response framing and may cause response desynchronization in deployments that rely on the incorrect Content-Length value. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Rack is a modular Ruby web server interface.CVE-2026-34830 · Other software · rack · reported by GitHubMedium 5.9
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Rack is a modular Ruby web server interface.CVE-2026-34829 · Other software · rack · reported by GitHubHigh 7.5
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfer encoding, multipart parsing continues until end-of-stream with no total size limit. For file parts, the uploaded body is written directly to a temporary file on disk rather than being constrained by the buffered in-memory upload limit. An unauthenticated attacker can therefore stream an arbitrarily large multipart file upload and consume unbounded disk space. This results in a denial of service condition for Rack applications that accept multipart form data. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Apr 2, 2026Rack is a modular Ruby web server interface.CVE-2026-34826 · Other software · rack · reported by GitHubMedium 5.3
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the file size, it does not restrict the count of ranges. An attacker can supply many small overlapping ranges such as 0-0,0-0,0-0,... to trigger disproportionate CPU, memory, I/O, and bandwidth consumption per request. This results in a denial of service condition in Rack file-serving paths that process multipart byte range responses. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Rack is a modular Ruby web server interface.CVE-2026-34786 · Other software · rack · reported by GitHubMedium 5.3
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static#applicable_rules evaluates several header_rules types against the raw URL-encoded PATH_INFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a URL-encoded variant of a static path can serve the same file without the headers that header_rules were intended to apply. In deployments that rely on Rack::Static to attach security-relevant response headers to static content, this can allow an attacker to bypass those headers by requesting an encoded form of the path. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Rack is a modular Ruby web server interface.CVE-2026-34785 · Other software · rack · reported by GitHubHigh 7.5
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path that begins with that string, including unrelated paths such as "/css-config.env" or "/css-backup.sql". As a result, files under the static root whose names merely share the configured prefix may be served unintentionally, leading to information disclosure. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Apr 2, 2026Rack is a modular Ruby web server interface.CVE-2026-34763 · Other software · rack · reported by GitHubMedium 5.3
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If root contains regex metacharacters such as +, *, or ., the prefix stripping can fail and the generated directory listing may expose the full filesystem path in the HTML output. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Rack is a modular Ruby web server interface.CVE-2026-34230 · Other software · rack · reported by GitHubMedium 5.3
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.select_best_encoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard (*) entries. Because this method is used by Rack::Deflater to choose a response encoding, an unauthenticated attacker can send a single request with a crafted Accept-Encoding header and cause disproportionate CPU consumption on the compression middleware path. This results in a denial of service condition for applications using Rack::Deflater. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Rack is a modular Ruby web server interface.CVE-2026-26961 · Other software · rack · reported by GitHubLow 3.7
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33026 · Other software · 0xJacky · reported by GitHubCritical 9.4
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33032 · Other software · 0xJacky · reported by GitHubCritical 9.8
Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware), the /mcp_message endpoint only applies IP whitelisting - and the default IP whitelist is empty, which the middleware treats as "allow all". This means any network attacker can invoke all MCP tools without authentication, including restarting nginx, creating/modifying/deleting nginx configuration files, and triggering automatic config reloads - achieving complete nginx service takeover. At time of publication, there are no publicly available patches.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33030 · Other software · 0xJacky · reported by GitHubHigh 8.8
Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application's base Model struct lacks a user_id field, and all resource endpoints perform queries by ID without verifying user ownership, enabling complete authorization bypass in multi-user environments. At time of publication, there are no publicly available patches.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33029 · Other software · 0xJacky · reported by GitHubMedium 6.9
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate configuration allows an authenticated user to cause a complete Denial of Service (DoS). By submitting a negative integer for the rotation interval, the backend enters an infinite loop or an invalid state, rendering the web interface unresponsive. This issue has been patched in version 2.3.4.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33028 · Other software · 0xJacky · reported by GitHubHigh 7.1
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerable to a Race Condition. Due to the complete absence of synchronization mechanisms (Mutex) and non-atomic file writes, concurrent requests lead to the severe corruption of the primary configuration file (app.ini). This vulnerability results in a persistent Denial of Service (DoS) and introduces a non-deterministic path for Remote Code Execution (RCE) through configuration cross-contamination. This issue has been patched in version 2.3.4.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33027 · Other software · 0xJacky · reported by GitHubMedium 6.9
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operation on the base directory (/etc/nginx). In particular, this allows an authenticated user to remove the entire /etc/nginx directory, resulting in a partial Denial of Service. This issue has been patched in version 2.3.4.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026NetworkActiv Web Server 4.0 contains a buffer overflow vulnerability in the username field of the Security options that allows local attackers to crash the applCVE-2018-25235 · Other software · Networkactiv · reported by VulnCheckMedium 6.9
NetworkActiv Web Server 4.0 contains a buffer overflow vulnerability in the username field of the Security options that allows local attackers to crash the application by supplying an excessively long string. Attackers can trigger a denial of service by entering a crafted username value exceeding the expected buffer size through the Set username interface.
- Product
- NetworkActiv Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comnetworkactiv.com
Mar 19, 2026ewe is a Gleam web server.CVE-2026-32881 · Other software · vshakitskiy · reported by GitHubMedium 5.3
ewe is a Gleam web server. ewe is a Gleam web server. Versions 0.6.0 through 3.0.4 are vulnerable to authentication bypass or spoofed proxy-trust headers. Chunked transfer encoding trailer handling merges declared trailer fields into req.headers after body parsing, but the denylist only blocks 9 header names. A malicious client can exploit this by declaring these headers in the Trailer field and appending them after the final chunk, causing request.set_header to overwrite legitimate values (e.g., those set by a reverse proxy). This enables attackers to forge authentication credentials, hijack sessions, bypass IP-based rate limiting, or spoof proxy-trust headers in any downstream middleware that reads headers after ewe.read_body is called. This issue has been fixed in version 3.0.5.
- Product
- ewe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026ewe is a Gleam web server.CVE-2026-32873 · Other software · vshakitskiy · reported by GitHubHigh 7.5
ewe is a Gleam web server. Versions 0.8.0 through 3.0.4 contain a bug in the handle_trailers function where rejected trailer headers (forbidden or undeclared) cause an infinite loop. When handle_trailers encounters such a trailer, three code paths (lines 520, 523, 526) recurse with the original buffer (rest) instead of advancing past the rejected header (Buffer(header_rest, 0)), causing decoder.decode_packet to re-parse the same header on every iteration. The resulting loop has no timeout or escape — the BEAM process permanently wedges at 100% CPU. Any application that calls ewe.read_body on chunked requests is affected, and this is exploitable by any unauthenticated remote client before control returns to application code, making an application-level workaround impossible. This issue is fixed in version 3.0.5.
- Product
- ewe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Easy File Sharing Web Server 7.2 contains a local structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary cCVE-2019-25466 · Other software · Sharing-File · reported by VulnCheckHigh 8.6
Easy File Sharing Web Server 7.2 contains a local structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by creating a malicious username. Attackers can craft a username with a payload containing 4059 bytes of padding followed by a nseh value and seh pointer to trigger the overflow when adding a new user account.
- Product
- Easy File Sharing Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Mar 6, 2026Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connectionsCVE-2018-25193 · Other software · Cesanta · reported by VulnCheckHigh 8.7
Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connections. Attackers can repeatedly create connections to the default port and send malformed data to exhaust server resources and cause service unavailability.
- Product
- Mongoose Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Mar 5, 2026TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32.CVE-2026-29046 · Other software · maximmasiutin · reported by GitHubCritical 9.2
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in header lines and header values, including CR, LF, and NUL, and did not consistently defend against encoded forms such as %0d, %0a, and %00. This can enable header value confusion across parser boundaries and may create unsafe data in the CGI execution context. This issue has been patched in version 2.04.
- Product
- TinyWeb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.