Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
850 results · page 5 of 17
Mar 18, 2026Glances is an open-source system cross-platform monitoring tool.CVE-2026-32634 · Other software · nicolargo · reported by GitHubHigh 8.1
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the discovered IP. When a dynamic server reports itself as protected, Glances also uses that same untrusted name as the lookup key for saved passwords and the global `[passwords] default` credential. An attacker on the same local network can advertise a fake Glances service over Zeroconf and cause the browser to automatically send a reusable Glances authentication secret to an attacker-controlled host. This affects the background polling path and the REST/WebUI click-through path in Central Browser mode. Version 4.5.2 fixes the issue.
- Product
- glances
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026Glances is an open-source system cross-platform monitoring tool.CVE-2026-32633 · Other software · nicolargo · reported by GitHubCritical 9.1
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server objects from `GlancesServersList.get_servers_list()`. Those objects are mutated in-place during background polling and can contain a `uri` field with embedded HTTP Basic credentials for downstream Glances servers, using the reusable pbkdf2-derived Glances authentication secret. If the front Glances Browser/API instance is started without `--password`, which is supported and common for internal network deployments, `/api/4/serverslist` is completely unauthenticated. Any network user who can reach the Browser API can retrieve reusable credentials for protected downstream Glances servers once they have been polled by the browser instance. Version 4.5.2 fixes the issue.
- Product
- glances
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026Glances is an open-source system cross-platform monitoring tool.CVE-2026-32632 · Other software · nicolargo · reported by GitHubMedium 5.9
Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary `Host` headers and does not apply `TrustedHostMiddleware` or an equivalent host allowlist. As a result, the REST API, WebUI, and token endpoint remain reachable through attacker-controlled domains in classic DNS rebinding scenarios. Once the victim browser has rebound the attacker domain to the Glances service, same-origin policy no longer protects the API because the browser considers the rebinding domain to be the origin. This is a distinct issue from the previously reported default CORS weakness. CORS is not required for exploitation here because DNS rebinding causes the victim browser to treat the malicious domain as same-origin with the rebinding target. Version 4.5.2 contains a patch for the issue.
- Product
- glances
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026Glances is an open-source system cross-platform monitoring tool.CVE-2026-32611 · Other software · nicolargo · reported by GitHubHigh 7
Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table name references do not escape or parameterize identifier names. Version 4.5.3 provides a more complete fix.
- Product
- glances
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026Glances is an open-source system cross-platform monitoring tool.CVE-2026-32610 · Other software · nicolargo · reported by GitHubHigh 8.1
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets `allow_origins=["*"]` combined with `allow_credentials=True`. When both of these options are enabled together, Starlette's `CORSMiddleware` reflects the requesting `Origin` header value in the `Access-Control-Allow-Origin` response header instead of returning the literal `*` wildcard. This effectively grants any website the ability to make credentialed cross-origin API requests to the Glances server, enabling cross-site data theft of system monitoring information, configuration secrets, and command line arguments from any user who has an active browser session with a Glances instance. Version 4.5.2 fixes the issue.
- Product
- glances
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026Glances is an open-source system cross-platform monitoring tool.CVE-2026-32609 · Other software · nicolargo · reported by GitHubHigh 7.5
Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible without any authentication. Version 4.5.2 provides a more complete fix.
- Product
- glances
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026Glances is an open-source system cross-platform monitoring tool.CVE-2026-32608 · Other software · nicolargo · reported by GitHubHigh 7
Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables (e.g., `{{name}}`, `{{key}}`) that are populated with runtime monitoring data. The `secure_popen()` function, which executes these commands, implements its own pipe, redirect, and chain operator handling by splitting the command string before passing each segment to `subprocess.Popen(shell=False)`. Prior to 4.5.2, when a Mustache-rendered value (such as a process name, filesystem mount point, or container name) contains pipe, redirect, or chain metacharacters, the rendered command is split in unintended ways, allowing an attacker who controls a process name or container name to inject arbitrary commands. Version 4.5.2 fixes the issue.
- Product
- glances
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026Glances is an open-source system cross-platform monitoring tool.CVE-2026-32596 · Other software · nicolargo · reported by GitHubHigh 8.7
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any network client. Version 4.5.2 fixes the issue.
- Product
- glances
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026Sentry is a developer-first error tracking and performance monitoring tool.CVE-2026-26004 · Other software · getsentry · reported by GitHubMedium 5.7
Sentry is a developer-first error tracking and performance monitoring tool. Versions prior to 26.1.0 have a cross-organization Insecure Direct Object Reference (IDOR) vulnerability in Sentry's GroupEventJsonView endpoint. Version 26.1.0 patches the issue.
- Product
- sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e.CVE-2026-32720 · Other software · ctfer-io · reported by GitHubHigh 7.1
The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). Prior to 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from a component to any other namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. This vulnerability is fixed in 0.2.1.
- Product
- monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-32598 · Other software · OneUptime · reported by GitHubMedium 6.9
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs (log aggregation, Docker logs, Kubernetes pod logs) can intercept reset tokens and perform account takeover on any user. This vulnerability is fixed in 10.0.24.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026WP Sessions Time Monitoring Full Automatic: Missing AuthorizationCVE-2026-32362 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through <= 1.1.3.
- Product
- WP Sessions Time Monitoring Full Automatic
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update WP Sessions Time Monitoring Full Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-32308 · Other software · OneUptime · reported by GitHubHigh 7.6
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams, enabling XSS through Mermaid's click directive which can execute arbitrary JavaScript. Any field that renders markdown (incident descriptions, status page announcements, monitor notes) is vulnerable. This vulnerability is fixed in 10.0.23.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-32306 · Other software · OneUptime · reported by GitHubCritical 9.9
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append() method (documented as "trusted SQL"). There is no allowlist, no parameterized query binding, and no input validation. An authenticated user can inject arbitrary SQL into ClickHouse, enabling full database read (including telemetry data from all tenants), data modification, and potential remote code execution via ClickHouse table functions. This vulnerability is fixed in 10.0.23.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026Uptime Kuma is an open source, self-hosted monitoring tool.CVE-2026-32230 · Other software · louislam · reported by GitHubMedium 5.3
Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this check entirely, allowing unauthenticated users to extract average ping/response time data for private monitors. This vulnerability is fixed in 2.2.0.
- Product
- uptime-kuma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicCVE-2026-2514 · Other software · Progress Software · reported by security@progress.comHigh 8.6
In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.
- Product
- Flowmon ADS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Mar 10, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-30959 · Other software · OneUptime · reported by GitHubMedium 5.3
OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-30958 · Other software · OneUptime · reported by GitHubHigh 7.2
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated directly into a file path passed to res.sendFile() in orker/FeatureSet/Workflow/Index.ts with no sanitization or authentication middleware. This vulnerability is fixed in 10.0.21.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-30957 · Other software · OneUptime · reported by GitHubCritical 9.9
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server/container. The root cause is that untrusted Synthetic Monitor code is executed inside Node's vm while live host-realm Playwright browser and page objects are exposed to it. A malicious user can call Playwright APIs on the injected browser object and cause the probe to spawn an attacker-controlled executable. This is a server-side remote code execution issue. It does not require a separate vm sandbox escape. This vulnerability is fixed in 10.0.21.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-30956 · Other software · OneUptime · reported by GitHubCritical 9.9
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and tenant scoping is disabled. This allows attackers to access project data belonging to other tenants, read sensitive User fields via nested relations, leak plaintext resetPasswordToken, and reset the victim’s password and fully take over the account. This results in cross‑tenant data exposure and full account takeover. This vulnerability is fixed in 10.0.21.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Glances is an open-source system cross-platform monitoring tool.CVE-2026-30930 · Other software · nicolargo · reported by GitHubHigh 7.3
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names. This vulnerability is fixed in 4.5.1.
- Product
- glances
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Glances is an open-source system cross-platform monitoring tool.CVE-2026-30928 · Other software · nicolargo · reported by GitHubHigh 8.7
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.
- Product
- glances
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authentiCVE-2025-11739 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.5
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.
- Product
- EcoStruxure™ Power Monitoring Expert (PME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Mar 10, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-30921 · Other software · OneUptime · reported by GitHubCritical 9.9
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.20, OneUptime Synthetic Monitors allow low-privileged project users to submit custom Playwright code that is executed on the oneuptime-probe service. In the current implementation, this untrusted code is run inside Node's vm and is given live host Playwright objects such as browser and page. This creates a distinct server-side RCE primitive: the attacker does not need the classic this.constructor.constructor(...) sandbox escape. Instead, the attacker can directly use the injected Playwright browser object to reach browser.browserType().launch(...) and spawn an arbitrary executable on the probe host/container. This vulnerability is fixed in 10.0.20.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-30920 · Other software · OneUptime · reported by GitHubHigh 8.6
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub App installation binding. Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create CodeRepository records in an arbitrary project. This vulnerability is fixed in 10.0.19.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-30887 · Other software · OneUptime · reported by GitHubCritical 9.9
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By leveraging a standard prototype-chain escape (this.constructor.constructor), an attacker can bypass the sandbox, gain access to the underlying Node.js process object, and execute arbitrary system commands (RCE) on the oneuptime-probe container. Furthermore, because the probe holds database/cluster credentials in its environment variables, this directly leads to a complete cluster compromise. This vulnerability is fixed in 10.0.18.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026UptimeFlare is a serverless uptime monitoring & status page solution, powered by Cloudflare Workers.CVE-2026-29779 · Other software · lyc8503 · reported by GitHubHigh 7.5
UptimeFlare is a serverless uptime monitoring & status page solution, powered by Cloudflare Workers. Prior to commit 377a596, configuration file uptime.config.ts exports both pageConfig (safe for client use) and workerConfig (server-only, contains sensitive data) from the same module. Due to pages/incidents.tsx importing and using workerConfig directly inside client-side component code, the entire workerConfig object was included in the client-side JavaScript bundle served to all visitors. This issue has been patched via commit 377a596.
- Product
- UptimeFlare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-28787 · Other software · OneUptime · reported by GitHubHigh 8.2
OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from the client request body during verification. This violates the WebAuthn specification (W3C Web Authentication Level 2, §13.4.3) and allows an attacker who has obtained a valid WebAuthn assertion (e.g., via XSS, MitM, or log exposure) to replay it indefinitely, completely bypassing the second-factor authentication. No known patches are available.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Beszel is a server monitoring platform.CVE-2026-27734 · Other software · henrygd · reported by GitHubMedium 6.5
Beszel is a server monitoring platform. Prior to version 0.18.2, the hub's authenticated API endpoints GET /api/beszel/containers/logs and GET /api/beszel/containers/info pass the user-supplied "container" query parameter to the agent without validation. The agent constructs Docker Engine API URLs using fmt.Sprintf with the raw value instead of url.PathEscape(). Since Go's http.Client does not sanitize `../` sequences from URL paths sent over unix sockets, an authenticated user (including readonly role) can traverse to arbitrary Docker API endpoints on agent hosts, exposing sensitive infrastructure details. Version 0.18.4 fixes the issue.
- Product
- beszel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-27728 · Other software · OneUptime · reported by GitHubCritical 9.9
OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in `NetworkPathMonitor.performTraceroute()` allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell metacharacters into a monitor's destination field. Version 10.0.7 fixes the vulnerability.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-27574 · Other software · OneUptime · reported by GitHubCritical 9.9
OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm module (explicitly documented as not a security mechanism) to execute user-supplied code, allowing trivial sandbox escape via a well-known one-liner that grants full access to the underlying process. Because the probe runs with host networking and holds all cluster credentials (ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, CLICKHOUSE_PASSWORD) in its environment variables, and monitor creation is available to the lowest role (ProjectMember) with open registration enabled by default, any anonymous user can achieve full cluster compromise in about 30 seconds. This issue has been fixed in version 10.0.5.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026Sentry is a developer-first error tracking and performance monitoring tool.CVE-2026-27197 · Other software · getsentry · reported by GitHubCritical 9.1
Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO implementation which allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. Self-hosted users are only at risk if the following criteria is met: ore than one organizations are configured (SENTRY_SINGLE_ORGANIZATION = True), or malicious user has existing access and permissions to modify SSO settings for another organization in a multo-organization instance. This issue has been fixed in version 26.2.0. To workaround this issue, implement user account-based two-factor authentication to prevent an attacker from being able to complete authentication with a victim's user account. Organization administrators cannot do this on a user's behalf, this requires individual users to ensure 2FA has been enabled for their account.
- Product
- sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability.CVE-2026-2042 · Other software · Nagios · reported by zdi-disclosures@trendmicro.comHigh 8.8
Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability. The specific flaw exists within the monitoringwizard module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28245.
- Product
- Host
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comzerodayinitiative.com
Feb 20, 2026openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus.CVE-2026-24892 · Other software · openITCOCKPIT · reported by GitHubHigh 7.5
openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. openITCOCKPIT Community Edition 5.3.1 and earlier contains an unsafe PHP deserialization pattern in the processing of changelog entries. Serialized changelog data derived from attacker-influenced application state is unserialized without restricting allowed classes. Although no current application endpoint was found to introduce PHP objects into this data path, the presence of an unrestricted unserialize() call constitutes a latent PHP object injection vulnerability. If future code changes, plugins, or refactors introduce object values into this path, the vulnerability could become immediately exploitable with severe impact, including potential remote code execution.
- Product
- openITCOCKPIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus.CVE-2026-24891 · Other software · openITCOCKPIT · reported by GitHubHigh 7.5
openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. Versions 5.3.1 and below contain an unsafe deserialization sink in the Gearman worker implementation. The worker function registered as oitc_gearman calls PHP's unserialize() on job payloads without enforcing class restrictions or validating data origin. While the intended deployment assumes only trusted internal components enqueue Gearman jobs, this trust boundary is not enforced in application code. In environments where the Gearman service or worker is exposed to untrusted systems, an attacker may submit crafted serialized payloads to trigger PHP Object Injection in the worker process. This vulnerability is exploitable when Gearman listens on non-local interfaces, network access to TCP/4730 is unrestricted, or untrusted systems can enqueue jobs. Default, correctly hardened deployments may not be immediately exploitable, but the unsafe sink remains present in code regardless of deployment configuration. Enforcing this trust boundary in code would significantly reduce risk and prevent exploitation in misconfigured environments. This issue has been fixed in ver
- Product
- openITCOCKPIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool.CVE-2026-26992 · Other software · librenms · reported by GitHubMedium 5.1
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the port group name is not sanitized, allowing attackers with admin privileges to perform Stored Cross-Site Scripting (XSS) attacks. When a user adds a port group, an HTTP POST request is sent to the Request-URI "/port-groups". The name of the newly created port group is stored in the value of the name parameter. After the port group is created, the entry is displayed along with relevant buttons such as Edit and Delete. This issue has been fixed in version 26.2.0.
- Product
- librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool.CVE-2026-26991 · Other software · librenms · reported by GitHubMedium 5.1
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the device group name is not sanitized, allowing attackers with admin privileges to perform Stored Cross-Site Scripting (XSS) attacks. When a user adds a device group, an HTTP POST request is sent to the Request-URI "/device-groups". The name of the newly created device group is stored in the value of the name parameter. After the device group is created, the entry is displayed along with relevant buttons such as Rediscover Devices, Edit, and Delete. This issue has been fixed in version 26.2.0.
- Product
- librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool.CVE-2026-27016 · Other software · librenms · reported by GitHubMedium 5.4
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks strip_tags() sanitization while other fields (name, oid, datatype) are sanitized. The unsanitized value is stored in the database and rendered without HTML escaping. This issue is fixed in version 26.2.0.
- Product
- librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool.CVE-2026-26990 · Other software · librenms · reported by GitHubHigh 8.8
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses. This vulnerability requires authentication and is exploitable by any authenticated user. This issue has been fixedd in version 26.2.0.
- Product
- librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool.CVE-2026-26989 · Other software · librenms · reported by GitHubMedium 4.3
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0.
- Product
- librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool.CVE-2026-26988 · Other software · librenms · reported by GitHubCritical 9.3
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically, the address parameter is split into an address and a prefix, and the prefix portion is directly concatenated into the SQL query string without validation. This allows an attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access or database manipulation. This issue has been fixed in version 26.2.0.
- Product
- librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool.CVE-2026-26987 · Other software · librenms · reported by GitHubMedium 5.3
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email field. This issue has been fixed in version 26.2.0.
- Product
- librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Mail Monitoring rule creation endpoint.CVE-2026-23608 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Mail Monitoring rule creation endpoint. An authenticated user can supply HTML/JavaScript in the JSON \"name\" field to /MailEssentials/pages/MailSecurity/MailMonitoring.aspx/Save, which is stored and later rendered in the management interface, allowing script execution in the context of a logged-in user.
- Product
- MailEssentials AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYSTEM.CVE-2025-15561 · Other software · NesterSoft Inc. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.8
An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYSTEM. A malicious executable must be named WTWatch.exe and dropped in the C:\ProgramData\wta\ClientExe directory, which is writable by "Everyone". The executable will then be run by the WorkTime monitoring daemon.
- Product
- WorkTime (on-prem/cloud)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026A weakness has been identified in Huace Monitoring and Early Warning System 2.2.CVE-2026-2620 · Other software · Huace · reported by VulDBMedium 5.5
A weakness has been identified in Huace Monitoring and Early Warning System 2.2. Affected by this issue is some unknown functionality of the file /Web/SysManage/ProjectRole.aspx. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Monitoring and Early Warning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026SQL Injection vulnerability in Shandong Kede Electronics Co., Ltd IoT smart water meter monitoring platform v.1.0 allows a remote attacker to execute arbitrary CVE-2025-63624 · Other software · Sdkede · reported by MITRECritical 9.8
SQL Injection vulnerability in Shandong Kede Electronics Co., Ltd IoT smart water meter monitoring platform v.1.0 allows a remote attacker to execute arbitrary code via the imei_list.aspx file.
- Product
- IOT Smart Water Meter Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026The Icinga PowerShell Framework provides configuration and check possibilities to ensure integration and monitoring of Windows environments.CVE-2026-24414 · Other software · Icinga · reported by GitHubMedium 6.8
The Icinga PowerShell Framework provides configuration and check possibilities to ensure integration and monitoring of Windows environments. In versions prior to 1.13.4, 1.12.4, and 1.11.2, permissions of the Icinga for Windows `certificate` directory grant every user read access, which results in the exposure of private key of the Icinga certificate for the given host. All installations are affected. Versions 1.13.4, 1.12.4, and 1.11.2 contains a patch. Please note that upgrading to a fixed version of Icinga for Windows will also automatically fix a similar issue present in Icinga 2, CVE-2026-24413. As a workaround, the permissions can be restricted manually by updating the ACL for the given folder `C:\Program Files\WindowsPowerShell\modules\icinga-powershell-framework\certificate` (and `C:\ProgramData\icinga2\var` to fix the issue for the Icinga 2 agent as well) including every sub-folder and item to restrict access for general users, only allowing the Icinga service user and administrators access.
- Product
- icinga-powershell-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026Icinga 2 is an open source monitoring system.CVE-2026-24413 · Other software · Icinga · reported by GitHubMedium 6.8
Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropriate permissions for the `%ProgramData%\icinga2\var` folder on Windows. This resulted in the its contents - including the private key of the user and synced configuration - being readable by all local users. All installations on Windows are affected. Versions 2.13.14, 2.14.8, and 2.15.2 contains a fix. There are two possibilities to work around the issue without upgrading Icinga 2. Upgrade Icinga for Windows to at least version v1.13.4, v1.12.4, or v1.11.2. These version will automatically fix the ACLs for the Icinga 2 agent as well. Alternatively, manually update the ACL for the given folder `C:\ProgramData\icinga2\var` (and `C:\Program Files\WindowsPowerShell\modules\icinga-powershell-framework\certificate` to fix the issue for the Icinga for Windows as well) including every sub-folder and item to restrict access for general users, only allowing the Icinga service user and administrators access.
- Product
- icinga2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying SQL database via BlinCVE-2025-59379 · Other software · Dwyeromega · reported by MITREHigh 7.5
DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying SQL database via Blind SQL Injection through the user parameter in the login page. This allows an attacker to steal credentials, which may be cleartext, from existing users (and admins) and use them to authenticate to the application.
- Product
- Isensix Advanced Remote Monitoring System Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.cominfo.dwyeromega.com
Jan 5, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQLCVE-2025-15029 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7Critical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
- Product
- Infra Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthewatch.centreon.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.