Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,148 results · page 5 of 303
Oct 17, 2026ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching aCVE-2026-111997 · Other software · beaugunderson · reported by MITREMedium 6.3
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.
- Product
- ip-address
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026OpenHuman is an open-source agent harness available as a desktop application and Rust library.CVE-2026-49410 · Other software · tinyhumansai · reported by GitHubHigh 8.1
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0.
- Product
- openhuman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-61726 · Other software · TandoorRecipes · reported by GitHubHigh 8.1
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-59970 · Other software · TandoorRecipes · reported by GitHubHigh 7.7
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider with a URL targeting an internal address, and invokes an AI action. In cookbook/views/api.py, the affected AI actions call completion through TARGET/api/ai-import/ and api/ai-step-sort/ while bypassing safe_request. The attack works because the server connects to the supplied provider URL from each AI action and exposes connection success, refusal, or timeout as a blind network-reachability oracle. This can reach internal services, other hosts on the server network, and cloud metadata endpoints and map reachable internal hosts and ports. This issue is fixed in version 2.6.10.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-59966 · Other software · TandoorRecipes · reported by GitHubMedium 5.7
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-59963 · Other software · TandoorRecipes · reported by GitHubHigh 7.1
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026ZoneMinder is a free, open source closed-circuit television software application.CVE-2026-30971 · Other software · ZoneMinder · reported by GitHubHigh 8.8
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026ZoneMinder is a free, open source closed-circuit television software application.CVE-2026-102608 · Other software · ZoneMinder · reported by GitHubCritical 9
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026ZoneMinder is a free, open source closed-circuit television software application.CVE-2026-102607 · Other software · ZoneMinder · reported by GitHubHigh 8.8
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create seCVE-2026-107674 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.1
IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service from starting or cause it to fallback to non-secure connections.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-59967 · Other software · TandoorRecipes · reported by GitHubMedium 5.4
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. Request processing uses api/recipe-from-source/, BookmarkletImport, filter, delete. The attack works because the endpoint parses and returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import. This can disclose authenticated or private captured page content and destroy another Space member's pending import. This issue is fixed in version 2.6.10.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-59962 · Other software · TandoorRecipes · reported by GitHubMedium 6.5
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Request processing uses _finalize_ordering and order_by through 8080/api/recipe/ and 8080/api/recipe-book/. The attack works because Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields. This can infer password hashes, email addresses, administrator status, and other related database values. This issue is fixed in version 2.6.10.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Dockhand is a Docker management application.CVE-2026-57169 · Other software · Finsys · reported by GitHubCritical 9.6
Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.
- Product
- dockhand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026pupnp is an SDK for development of UPnP device and control point applications.CVE-2026-77630 · Other software · pupnp · reported by GitHubHigh 7.5
pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.
- Product
- pupnp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026pupnp is an SDK for development of UPnP device and control point applications.CVE-2026-57488 · Other software · pupnp · reported by GitHubHigh 7.1
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser can accept a body length different from the declared value. A remote adjacent-network peer can use the resulting parser disagreement to leave bytes to be interpreted as another request in persistent or proxied contexts, or can make a worker wait for an extremely large body and cause denial of service. This issue is fixed in 2.0.2.
- Product
- pupnp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026pupnp is an SDK for development of UPnP device and control point applications.CVE-2026-57487 · Other software · pupnp · reported by GitHubHigh 7.5
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.
- Product
- pupnp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026pupnp is an SDK for development of UPnP device and control point applications.CVE-2026-57486 · Other software · pupnp · reported by GitHubHigh 7.5
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.
- Product
- pupnp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026pupnp is an SDK for development of UPnP device and control point applications.CVE-2026-55862 · Other software · pupnp · reported by GitHubMedium 6.5
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and ixmlNode_getElementsByTagNameRecursive, ixmlNode_getElementsByTagNameNSRecursive, ixmlNode_cloneNodeTreeRecursive, and ixmlNode_isAncestor in ixml/src/node.c recurse over firstChild and nextSibling links. An unauthenticated peer on the local network can supply deeply nested XML through a SOAP request, exhaust a service thread's stack, and crash the UPnP service. This is an incomplete-fix case for CVE-2021-28302 because its remediation converted ixmlNode_free but left these traversal paths recursive. This issue is fixed in 2.0.0.
- Product
- pupnp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application.CVE-2026-105667 · Other software · J4Care · reported by ics-cert@hq.dhs.govHigh 8.7
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.
- Product
- dcm4chee-arc-light
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switcCVE-2026-19076 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.4
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which allows an attacker with a valid OAuth bearer token for a target user to permanently take over that user's SSO-backed account by setting an attacker-controlled password and detaching the account from its identity provider via a crafted request to POST /api/v4/users/login/switch.. Mattermost Advisory ID: MMSA-2026-00758
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application.CVE-2026-111450 · Other software · Wheels · reported by MITREMedium 5.9
Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request triggers a cold start can direct later error emails to an address under their control for that application's lifetime. Emails disclose error and request metadata; on engines/versions where scope dumps render, they may also disclose configuration secrets and other users' session/cookie data. On the Lucee 7 engine, scope dumps fail to render, limiting disclosure to header fields. This is fixed in 4.1.2.
- Product
- Wheels
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request daCVE-2026-111444 · Other software · Wheels · reported by MITRECritical 9.8
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.
- Product
- Wheels
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-CVE-2026-111443 · Other software · Wheels · reported by MITREMedium 6.5
Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the query string. The alternate application uses the same configuration, environment, datasource and debug settings: this is not an authentication bypass or data/debug escalation. It can bypass maintenance mode enabled only at runtime, provide a second set of in-memory rate-limit counters, and trigger additional application-startup side effects and memory use. This is fixed in 4.2.0.
- Product
- Wheels
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on theCVE-2026-75941 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.6
A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.
- Product
- Legion Zone Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026ZoneMinder is a free, open source closed-circuit television software application.CVE-2026-104198 · Other software · ZoneMinder · reported by GitHubMedium 5.3
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped. This can dispatch views that rely on the outer authentication gate, including the zones view, which accepts an attacker-selected monitor ID and discloses monitor and zone metadata without an independent permission check. Permission helpers receive the false user value and deny privileged operations, so unauthorized state changes have not been established. This vulnerability is fixed in version 1.36.63, where conversion to ZM\User objects causes invalid token state to fail before view dispatch. Later defense-in-depth changes explicitly leave $user unset after failed token validation and reject non-ZM\User values at the web authentication gate.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing.CVE-2026-57496 · Other software · Labs64 · reported by GitHubCritical 9.6
NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product passes the caller-controlled product_number to src/netlicensing_mcp/tools/products.py, which interpolates it into a REST path consumed by nl_get() in src/netlicensing_mcp/client.py without path-segment validation. A traversal segment can be normalized from the intended product path to the /token endpoint, after which the response is serialized through _wrap_json instead of _wrap_json_token_read, bypassing redact_token_read() protections for APIKEY number and SHOP shopURL fields. An authenticated MCP client with a non-administrative API key can retrieve plaintext token values, and a recovered administrative token can provide broad read, write, and delete access to the NetLicensing account. This issue is fixed in version 0.1.8.
- Product
- NetLicensing-MCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_Emu::mute_voices_ that allows attackers to crash applicationCVE-2026-111153 · Other software · libgme · reported by VulnCheckMedium 6.8
Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_Emu::mute_voices_ that allows attackers to crash applications by supplying NSF files whose voice count exceeds the 16-entry voice-type table. Attackers can craft an NSF header with chip_flags 0x3F, opened through gme_open_data or gme_open_file, to read past the static array during loading and cause denial of service.
- Product
- game-music-emu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unCVE-2026-111148 · Other software · libsidplayfp · reported by VulnCheckMedium 6.8
libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs() reads up to 64 KiB past the heap buffer.
- Product
- libsidplayfp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilove_xbin() that allows attackers to crash applications by supplying a CVE-2026-111144 · Other software · ansilove · reported by VulnCheckMedium 6.8
libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilove_xbin() that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar() to index a NULL high_font_data_xbin pointer and terminate the process.
- Product
- libansilove
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone iCVE-2026-111128 · Other software · assimp · reported by VulnCheckMedium 6.8
Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById() to return null and crash the host process.
- Product
- assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses.CVE-2026-102740 · Other software · AsyncHttpClient · reported by GitHubMedium 5.8
The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default permissions and link-following file operations. A local user who can read the shared store can see download URLs, including embedded user information or query tokens. A local user who can write within or pre-create the affected shared store directory can plant a symbolic link that the client follows when saving state, truncating and overwriting a target file writable by the client process. The filesystem path is used when ResumableAsyncHandler decorates another AsyncHandler, while the no-argument constructors use a no-op processor and are unaffected. This issue is fixed in versions 2.16.1 and 3.0.12.
- Product
- async-http-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026EspoCRM is an open source customer relationship management application.CVE-2026-75505 · Other software · espocrm · reported by GitHubMedium 6
EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the caller can read it, bypassing record-level and field-level restrictions and exposing the file contents through the copied attachment. Obtaining a valid attachment identifier may be difficult. This issue is fixed in version 10.0.2.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application cCVE-2026-95180 · Other software · reported by MITREMedium 5.5
An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in DefaultWebClient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.CVE-2026-79840 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.3
A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.
- Product
- HPE NonStop XABroker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash.CVE-2026-79839 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.3
A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash.
- Product
- HPE NonStop ODBC/MX Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash.CVE-2026-79838 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.3
A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash.
- Product
- HPE NonStop ODBC/MX Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026EspoCRM is an open source customer relationship management application.CVE-2026-77460 · Other software · espocrm · reported by GitHubMedium 6.5
EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is disabled. The same behavior affects group email auto-replies when a regular user can edit the selected template, even though an administrator controls the group email. Rendered messages can disclose restricted user fields. This issue is fixed in version 10.0.3.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026EspoCRM is an open source customer relationship management application.CVE-2026-63130 · Other software · espocrm · reported by GitHubMedium 5.5
EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying, creating, or deleting JSON files accessible to the application, subject to filesystem permissions and server configuration. This issue is fixed in version 9.3.10.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026EspoCRM is an open source customer relationship management application.CVE-2026-59994 · Other software · espocrm · reported by GitHubMedium 4.3
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a monitored group or IMAP address, including an email-to-Case address, and place arbitrary HTML in its plain-text body. EspoCRM stores that body and renders it without escaping in Email Received stream notification emails sent to users following the related record, allowing HTML injection and, in mail clients that execute it, JavaScript execution. Earlier sanitization for Post and Mention notifications did not cover this notification path. This issue is fixed in version 9.3.9.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026EspoCRM is an open source customer relationship management application.CVE-2026-55184 · Other software · espocrm · reported by GitHubLow 3.5
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml(). When another user opens the template in edit mode and clientCspDisabled is true, the stored payload executes and can hijack the user's session. This issue is fixed in version 9.3.9.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026EspoCRM is an open source customer relationship management application.CVE-2026-55154 · Other software · espocrm · reported by GitHubMedium 5.4
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only the first byte in sanitizeCellValue(). An authenticated low-privileged user can store a free-text value whose formula trigger is preceded by whitespace or a control character, causing CSV or XLSX export to omit the leading single-quote formula-neutralization prefix. When a privileged user opens the exported file and accepts applicable spreadsheet security prompts, spreadsheet software can ignore the whitespace or control-character prefix and evaluate the cell as a formula, permitting outbound data disclosure and, on legacy configurations with DDE enabled, command execution. This issue is fixed in version 9.3.9.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026EspoCRM is an open source customer relationship management application.CVE-2026-53575 · Other software · espocrm · reported by GitHubLow 2.7
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowing attacker-controlled JavaScript to run in users' sessions and leak page data, including unsaved user input. This issue is fixed in version 9.3.9.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026EspoCRM is an open source customer relationship management application.CVE-2026-53574 · Other software · espocrm · reported by GitHubHigh 7.6
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation. This issue is fixed in version 9.3.8.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026EspoCRM is an open source customer relationship management application.CVE-2026-47168 · Other software · espocrm · reported by GitHubCritical 9.1
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026EspoCRM is an open source customer relationship management application.CVE-2026-46708 · Other software · espocrm · reported by GitHubMedium 4.3
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the target list but retrieves the target record without the required record authorization, allowing unauthorized changes to its opted_out relationship state. This issue is fixed in version 9.3.7.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026EspoCRM is an open source customer relationship management application.CVE-2026-46694 · Other software · espocrm · reported by GitHubMedium 6.5
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list responses correctly hide notes whose isInternal field is true, but the direct single-Note access check does not enforce that restriction, exposing internal agent content. This issue is fixed in version 9.3.7.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026EspoCRM is an open source customer relationship management application.CVE-2026-46691 · Other software · espocrm · reported by GitHubMedium 6.5
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/{id}/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that import. The endpoint performs a scope-level check but omits the entity-level ownership check enforced by the Import AccessChecker and sibling Import endpoints. This issue is fixed in version 9.3.7.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2026-108082 · Other software · sensiolabs · reported by 596c5446-0ce5-4ba2-aa66-48b3b757a647High 8.7
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication. A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped. This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted bCVE-2026-75559 · Other software · Ministry of Land, Infrastructure, Transport and Tourism · reported by vultures@jpcert.or.jpMedium 6.9
The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted by the application, potentially leading to the exposure of API integration credentials such as an access ID and access key.
- Product
- Vehicle Inspection Certificate Viewer (for Android)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient vCVE-2026-101290 · Other software · SICK AG · reported by psirt@sick.deHigh 7.5
A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash and a denial-of-service condition.
- Product
- Sick_Safetyscanners_Base CPP Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.