Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
772 results · page 5 of 16
Aug 15, 2026A vulnerability was determined in OpenBoxes up to 0.9.7.CVE-2026-19928 · Other software · reported by VulDBLow 2.1
A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.8-hotfix1 and 0.9.8 mitigates this issue. This patch is called 788cace0af816aa972a713a4631c57f16f895e6b. Upgrading the affected component is recommended.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 15, 2026A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02.CVE-2026-19891 · Other software · TRENDnet · reported by VulDBMedium 6.3
A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchange_mode causes missing encryption of sensitive data. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The vendor was contacted early about this disclosure.
- Product
- TEW-WLC100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapp.notion.comvuldb.com
Aug 14, 2026A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730.CVE-2026-19845 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. Executing a manipulation of the argument Comment can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- A800R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026A vulnerability was determined in Webkul Bagisto up to 2.4.4.CVE-2026-19834 · Other software · Webkul · reported by VulDBLow 2
A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
- Product
- Bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01.CVE-2026-19821 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- AC12
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01.CVE-2026-19789 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects the function set_wl_guest_iplist of the file /goform/WifiGuestSet of the component httpd web management interface. This manipulation of the argument shareSpeed causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- AC1206
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026A vulnerability was determined in DTStack Taier 1.4.0.CVE-2026-19763 · Other software · DTStack · reported by VulDBMedium 5.1
A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the component Cluster Creation. This manipulation of the argument clusterName causes path traversal. Remote exploitation of the attack is possible. Upgrading to version 1.5.0 can resolve this issue. Patch name: ec8c59c76aceb04ab3080543ab2d9c6a4b674729. The affected component should be upgraded.
- Product
- Taier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026A vulnerability was determined in dromara lamp-cloud up to 5.10.0.CVE-2026-19758 · Other software · dromara · reported by VulDBMedium 5.5
A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- lamp-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can CVE-2026-72655 · Other software · Elastic · reported by security@elastic.coMedium 4.3
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating User-Controlled Variables (CAPEC-77). Object attributes accepted by the case management API were not subject to the same authorization enforcement applied in the user interface, so a low-privileged user could alter case records they were only entitled to view.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A vulnerability was determined in Open5GS up to 2.7.1.CVE-2024-14043 · Other software · reported by VulDBLow 2.1
A vulnerability was determined in Open5GS up to 2.7.1. This vulnerability affects the function mme_s6a_subscription_data_from_avp of the file src/mme/mme-fd-path.c of the component Diameter S6a Interface. Executing a manipulation of the argument msisdn_len can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.7.2 is able to resolve this issue. This patch is called 7ea82cb87bb65c3694d8d7c7a5efed1c4d3c9304. Upgrading the affected component is recommended.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A vulnerability was determined in EFM ipTIME AX8004M 15.09.0.CVE-2026-19379 · Other software · EFM · reported by VulDBMedium 5.5
A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ipTIME AX8004M
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0.CVE-2026-19370 · Other software · bartekke8it56w2 · reported by VulDBLow 1.9
A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes path traversal. The attack requires local access. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- new-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A vulnerability was determined in MingSoft MCMS up to 3.0.6.CVE-2026-19355 · Other software · MingSoft · reported by VulDBMedium 5.5
A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A vulnerability was determined in mifi lossless-cut up to 3.69.0.CVE-2026-19352 · Other software · mifi · reported by VulDBLow 1.3
A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the local network. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 260802348955231442c4bae6c2d9d8ede947af0a. It is best practice to apply a patch to resolve this issue. The project maintainer provides this view: "I'm not sure that this is a critical vulnerability, because it is behind an experimental CLI flag and the NTLM behavior isn't really a LosslessCut bug." The CVSS vector reflects the high level of pre-requisites.
- Product
- lossless-cut
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2026-19346 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Aug 9, 2026A vulnerability was determined in adenot mcp-google-search up to 0.3.1.CVE-2026-19337 · Other software · adenot · reported by VulDBLow 1.9
A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component read_webpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This patch is called f071d491b685011ca04e8ab8d586fc65f86bcee1. It is advisable to implement a patch to correct this issue.
- Product
- mcp-google-search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0.CVE-2026-19330 · Other software · angrysky56 · reported by VulDBLow 1.9
A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0. The impacted element is the function create_system_json/create_library to get_system_json/switch_memory_library of the file src/index.ts. This manipulation causes path traversal. The attack requires local access. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- advanced-reasoning-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2026A vulnerability was determined in Kirachon context-engine up to 1.9.0.CVE-2026-19266 · Other software · Kirachon · reported by VulDBMedium 5.1
A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1 mitigates this issue. This patch is called e0729dcfd3a2b1682a7bff86e7174852c03419ba. It is advisable to upgrade the affected component.
- Product
- context-engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026A vulnerability was determined in WonderTrader up to 0.9.9.CVE-2026-19212 · Other software · reported by VulDBLow 2.1
A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument m_offsetType can lead to use of uninitialized variable. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026A vulnerability was determined in DataGear up to 5.0.0.CVE-2026-19110 · Other software · reported by VulDBLow 1.9
A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2.CVE-2026-19059 · Other software · FoundationAgents · reported by VulDBLow 1.9
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulation causes path traversal. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MetaGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Aug 6, 2026A vulnerability was determined in Shibby Tomato 1.28.0000.CVE-2026-19034 · Other software · Shibby · reported by VulDBHigh 7.3
A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function new_qoslimit_stop of the file /tmp/qoslimittc_stop.sh. Executing a manipulation of the argument wan_iface can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.
- Product
- Tomato
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026A vulnerability was determined in OpenHands up to 0.62.0.CVE-2026-19022 · Other software · reported by VulDBMedium 5.3
A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue report. It appears that the affected path/file got removed in version 1.7.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1.CVE-2026-19007 · Other software · mf-yang · reported by VulDBLow 2.1
A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/reply/reply-elevated.ts. This manipulation causes improper privilege management. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- openclaw-cn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12.CVE-2026-18998 · Other software · cosmicstack-labs · reported by VulDBLow 2.1
A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegate_task Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mercury-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026A vulnerability was determined in NousResearch hermes-agent up to 0.16.0.CVE-2026-18976 · Other software · NousResearch · reported by VulDBLow 2.1
A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function get_tool_definitions of the file agent/agent_init.py of the component disabled_toolsets Handler. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.
- Product
- hermes-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c.CVE-2026-18927 · Other software · imranrisal-dev · reported by VulDBLow 2.1
A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file student_profile_pic.php of the component Shared Upload Helper. Executing a manipulation of the argument choose_file can lead to unrestricted upload. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Student-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4.CVE-2026-18903 · Other software · yeqifu · reported by VulDBLow 2.1
A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects some unknown processing of the file src/main/java/com/yeqifu/sys/controller/FileController.java. This manipulation of the argument path causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- warehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfanatical-brain-9ba.notion.sitevuldb.com
Aug 4, 2026A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0.CVE-2026-18896 · Other software · lavkush-maurya · reported by VulDBLow 2.1
A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0. The affected element is an unknown function of the file /student/changepass.php. Executing a manipulation of the argument oldpass can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Student-Registration-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33.CVE-2026-18856 · Other software · Poesis · reported by VulDBLow 2
A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.34 will fix this issue. It is recommended to upgrade the affected component.
- Product
- Rhymix CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b.CVE-2026-18785 · Other software · o6 · reported by VulDBLow 1.9
A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UA_Client_getRemoteDataTypes of the file examples/custom_datatype/client_types_custom.c. Executing a manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project closed the issue report, stating that this is not the official way to report a security vulnerability.
- Product
- open62541
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026A vulnerability was determined in diaowen DWSurvey up to 6.14.0.CVE-2026-18723 · Other software · diaowen · reported by VulDBLow 2.1
A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DWSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Aug 3, 2026A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13.CVE-2026-18641 · Other software · Sangfor · reported by VulDBMedium 5.5
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portal_login of the component Login Endpoint. This manipulation causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Operation and Maintenance Security Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5.CVE-2026-18615 · Other software · GL-iNet · reported by VulDBHigh 8.9
A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument private_key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
- Product
- GL-MT3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5.CVE-2026-18602 · Other software · GL.iNet · reported by VulDBHigh 8.9
A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
- Product
- GL-MT3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628.CVE-2026-18590 · Other software · Wavlink · reported by VulDBLow 2.1
A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- WL-NU516U1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.wavlink.comgithub.com
Aug 2, 2026A vulnerability was determined in ggml-org llama.cpp e15efe0.CVE-2026-18581 · Other software · ggml-org · reported by VulDBLow 1.9
A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input {{9|9|{ can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- llama.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.proton.megithub.com
Jul 27, 2026A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3.CVE-2026-17514 · Other software · ZJONSSON · reported by VulDBLow 1.9
A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- node-unzipper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2026A vulnerability was determined in perwendel spark up to 2.9.4.CVE-2026-17459 · Other software · perwendel · reported by VulDBLow 2.1
A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- spark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2026Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue.CVE-2026-9765 · Other software · Grafana · reported by security@grafana.comHigh 7.1
Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. Broken access control can allow attackers to: Access resources only accessible to certain users, thus allowing unauthorized access to data Perform operations on behalf of other users, leading to account takeovers in the worst cases Attempt privilege escalation Attempt to take over an account
- Product
- Grafana IRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026A vulnerability was determined in CodeAstro Online Classroom 1.0.CVE-2026-16765 · Other software · CodeAstro · reported by VulDBMedium 5.5
A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Online Classroom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Jul 21, 2026A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0.CVE-2026-16488 · Other software · QUSETIONS · reported by VulDBLow 1.3
A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.1.0-rc1 is able to resolve this issue. This patch is called 9d868dc2550f426c6ddf8ee98f30ffe450ca5e32. It is suggested to upgrade the affected component.
- Product
- MiniCode-Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 21, 2026A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead.CVE-2026-16449 · Other software · zsadmin2025 · reported by VulDBLow 2.1
A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/OrderItem.desc of the file /api/system/sys/dept/page of the component com.zs.sys.dept.controller.SysDeptController. This manipulation of the argument orderField causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- ZS-Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026A vulnerability was determined in D-Link DNS-320 1.0.2.CVE-2026-16327 · Network & remote access · D-Link · reported by VulDBMedium 5.5
A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DNS-320
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorducn9h68n9289.feishu.cnvuldb.com
Jul 19, 2026A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1.CVE-2026-16223 · Other software · 1Panel-dev · reported by VulDBLow 2.1
A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CordysCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2026A vulnerability was determined in allegro up to bcf65b994ef29fb3fc2e10b660e6288723d5209e.CVE-2026-16211 · Other software · reported by VulDBLow 1.2
A vulnerability was determined in allegro up to bcf65b994ef29fb3fc2e10b660e6288723d5209e. This impacts the function AssetLastHostname.increment_hostname of the file src/ralph/assets/models/assets.py of the component Hostname Allocation Handler. Executing a manipulation of the argument counter can lead to race condition. Attacks of this nature are highly complex. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2026A vulnerability was determined in zhayujie CowAgent up to 2.1.1.CVE-2026-16194 · Other software · zhayujie · reported by VulDBLow 2.1
A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web_fetch/web_fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is able to mitigate this issue. This patch is called ea47f3097eed4f8295c4cb3d76ecb97e0f43d632. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- CowAgent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2026A vulnerability was determined in zevorn rt-claw up to 0.2.0.CVE-2026-16126 · Other software · zevorn · reported by VulDBMedium 5.5
A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle_rpc_request of the file claw/services/swarm/swarm.c of the component Swarm RPC Receiver. This manipulation causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- rt-claw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2026A vulnerability was determined in nextlevelbuilder GoClaw up to 3.13.3-beta.3.CVE-2026-16120 · Other software · nextlevelbuilder · reported by VulDBLow 2.1
A vulnerability was determined in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This impacts the function matchesAllowlist/extractBin of the file internal/tools/exec_approval.go. Executing a manipulation can lead to incorrectly-resolved name. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
- Product
- GoClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2026A vulnerability was determined in Sipeed PicoClaw up to 0.2.9.CVE-2026-16081 · Other software · Sipeed · reported by VulDBLow 2.1
A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.go. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 4b0229351678f479429b8d8b19207757266f246b. Applying a patch is advised to resolve this issue.
- Product
- PicoClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.