Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,292 results · page 51 of 346
Jul 19, 2026CI4MS is a CodeIgniter 4-based content management system skeleton.CVE-2026-45138 · Other software · ci4-cms-erp · reported by GitHubMedium 5.4
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` validation rule used to sanitize blog post bodies relies on by-reference mutation (`?string &$str`), but CodeIgniter 4's validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes `$lanData['content']` directly into `blog_langs.content`, and the public template echoes it without escaping — yielding stored XSS executable in any visitor's browser, including the superadmin when previewing or editing posts. Version 0.31.9.0 patches the issue.
- Product
- ci4ms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2026In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in create_bo rocket_ioctl_create_bo() insertCVE-2026-64008 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in create_bo rocket_ioctl_create_bo() inserts a GEM handle into the file's IDR via drm_gem_handle_create() early on, then performs several operations that can fail (sgt allocation, drm_mm insert, iommu_map). If any fail after the handle is live, the error path calls drm_gem_shmem_object_free() which kfree's the object without removing the handle from the IDR. This leaves a dangling handle pointing to freed slab memory. Any subsequent ioctl using that handle (PREP_BO, FINI_BO, SUBMIT) calls drm_gem_object_lookup() and dereferences freed memory (UAF). Fix by moving drm_gem_handle_create() to after all fallible operations succeed, matching the pattern used by panfrost, lima, and etnaviv. Also fix drm_mm_insert_node_generic() whose return value was silently overwritten by iommu_map_sgtable() on the next line. Add the missing error check. [tomeu: Move handle creation to the very end]
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 19, 2026In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between change_handle and handle_delete drm_gem_change_handle_ioctl leavCVE-2026-63885 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.8
In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between change_handle and handle_delete drm_gem_change_handle_ioctl leaves the old handle live in the IDR during the window between spin_unlock(table_lock) and the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle succeeds in this window, decrements handle_count to 0, and frees the GEM object while the new handle's IDR entry still references it. NULL the old handle's IDR entry before dropping table_lock so that any concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL. Restore the old entry on the prime-bookkeeping error path.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 19, 2026In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO The AMDGPU_GEM_OP_GECVE-2026-63880 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO The AMDGPU_GEM_OP_GET_MAPPING_INFO branch of amdgpu_gem_op_ioctl() holds three cleanup-tracked resources before calling kvcalloc(): the drm_gem_object reference from drm_gem_object_lookup(), the drm_exec lock on the looked-up GEM via drm_exec_lock_obj(), and the drm_exec lock on the per-process VM root page directory via amdgpu_vm_lock_pd(). All three are released by the out_exec label that every other error path in this function jumps to. The kvcalloc() failure path returns -ENOMEM directly, skipping out_exec and leaking all three. The leaked per-process VM root PD dma_resv lock is the load-bearing leak: any subsequent operation on the same VM (further GEM ops, command-submission, eviction, TTM shrinker callbacks) blocks on the held lock. DRM_IOCTL_AMDGPU_GEM_OP is DRM_AUTH | DRM_RENDER_ALLOW, so this is an unprivileged-local denial of service against the caller's GPU context, reachable by any process with /dev/dri/renderD* access. Route the failure through out_exec so drm_exec_fini() and drm_gem_object_put() run. Reproduced on stock 7.0.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 19, 2026In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO kvcalloc(args->num_entries, sizeoCVE-2026-63878 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO kvcalloc(args->num_entries, sizeof(*vm_entries), GFP_KERNEL) at amdgpu_gem.c:1050 uses the user-supplied num_entries directly without any upper bounds check. Since num_entries is a __u32 and sizeof(drm_amdgpu_gem_vm_entry) is 32 bytes, a large num_entries produces an allocation exceeding INT_MAX, triggering WARNING in __kvmalloc_node_noprof(), causing a kernel WARNING, TAINT_WARN, and panic on CONFIG_PANIC_ON_WARN=y systems. Add a size bounds check before we invoke the kvzalloc() to reject oversized num_entries early with -EINVAL. (cherry picked from commit 1fe7bf5457f6efd7be60b17e23163ba54341d73d)
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 17, 2026Statamic is a Laravel and Git powered content management system (CMS).CVE-2026-54244 · Other software · statamic · reported by GitHubLow 3.5
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it. This issue is fixed in versions 5.74.0 and 6.20.3.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Statamic is a Laravel and Git powered content management system (CMS).CVE-2026-54243 · Other software · statamic · reported by GitHubMedium 6.1
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula trigger character, such as =, +, -, or @, could be interpreted as a live formula when a Control Panel user opens the export in a spreadsheet application. Form submissions can come from unauthenticated front-end visitors, so the malicious value can be supplied by an anonymous user and is later triggered by an editor opening the export. This issue is fixed in versions 5.73.24 and 6.20.1.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Statamic is a Laravel and Git powered content management system (CMS).CVE-2026-54242 · Other software · statamic · reported by GitHubMedium 4.9
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly routable, but resolved again when the image was actually fetched, so an attacker controlling the hostname's DNS could rebind it to an internal address after validation and cause the server to make HTTP requests to internal addresses, including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. This issue is fixed in versions 5.73.24 and 6.20.1.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Pimcore is an Open Source Data & Experience Management Platform.CVE-2026-45704 · Other software · pimcore · reported by GitHubHigh 7.1
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses inconsistent authorization between the report listing endpoint and the report detail endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php and bundles/CustomReportsBundle/src/Tool/Config/Listing/Dao.php, allowing a low-privileged backend user with the reports permission to directly request an unshared report such as poc-secret-report by name and read report name, grouping information, display and icon metadata, data source configuration, column configuration, and sharing settings even when shareGlobally is false. This issue is fixed in versions 11.5.17 (LTS) and 12.3.6.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Pimcore is an Open Source Data & Experience Management Platform.CVE-2026-45260 · Other software · pimcore · reported by GitHubHigh 8.1
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation through /asset/webdav{path} without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php, and models/Asset/WebDAV/Tree.php performs asset mutation and deletion through models/Asset.php before checking a current Pimcore user or the rename, delete, create, or publish permissions, allowing unauthorized asset deletion, moves, or overwrites. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Pimcore is an Open Source Data & Experience Management Platform.CVE-2026-44739 · Other software · pimcore · reported by GitHubHigh 8.7
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php passes malicious SQL configuration through CustomReportController:columnConfigAction, SqlAdapter::getColumns, SqlAdapter::buildQueryString, and Db::fetchAssociative(), allowing an attacker with the reports_config permission to use arbitrary SELECT queries, UNION statements, dangerous database functions, and error-based SQL injection to exfiltrate or manipulate database data. This issue is fixed in versions 11.5.17 (LTS) and 12.3.6.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 ICVE-2026-14979 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion.
- Product
- Engineering Lifecycle Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Pimcore is an Open Source Data & Experience Management Platform.CVE-2026-45703 · Other software · pimcore · reported by GitHubMedium 6.4
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, the WordExport export flow in bundles/WordExportBundle/src/Controller/TranslationController.php only checks the word_export feature permission and directly resolves attacker-controlled type/id input without enforcing view permission on page, snippet, email, or object elements, allowing a low-privileged backend user to export document content the user is not allowed to view. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Pimcore is an Open Source Data & Experience Management Platform.CVE-2026-45162 · Other software · pimcore · reported by GitHubHigh 8
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Asset/WebDAV/Service.php, and admin-ui-classic-bundle/src/Helper/Dashboard.php, enabling object injection and remote code execution if an attacker can control the serialized data source. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and CVE-2026-8297 · Other software · Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 through 08072026.
- Product
- GisLab Laboratory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026A flaw was found in the admin REST API of Keycloak, a solution for identity and access management.CVE-2026-16106 · Other software · Red Hat · reported by Red HatMedium 4.9
A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can remove privileged roles they are not authorized to manage, leading to a loss of access for other users and administrators.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 17, 2026Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc.CVE-2026-11763 · Other software · Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. · reported by iletisim@usom.gov.trMedium 6.5
Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows Exploitation of Trusted Identifiers. This issue affects GisLab Laboratory Management System: from 1.4.03 through 08072026.
- Product
- GisLab Laboratory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026A flaw was found in the organization management component of Keycloak.CVE-2026-16072 · Other software · Red Hat · reported by Red HatMedium 4.9
A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface. By using this link, the administrator can create new user accounts and add them to the organization without having the required user management permissions or access to the invited email account. This allows an administrator to bypass security boundaries and add unauthorized members to an organization.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 17, 2026AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint.CVE-2025-60357 · Other software · Ahnlab · reported by MITREHigh 8.1
AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint.
- Product
- EPP Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers.CVE-2026-15943 · Other software · Red Hat · reported by Red HatMedium 5.5
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 17, 2026A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption rCVE-2026-15380 · Other software · Broadcom · reported by secure@symantec.comMedium 5.1
A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required (ITMS 8.7.3)
- Product
- Symantec Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user to read the contents of any file accessible to the SYSTEM accCVE-2026-15379 · Other software · Broadcom · reported by secure@symantec.comMedium 5.1
The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user to read the contents of any file accessible to the SYSTEM account, bypassing filesystem ACLs. No admin privileges required. The provider reverts to the LocalSystem context when servicing WMI queries without re-impersonating the caller. Any local standard user can therefore read SYSTEM-readable files — including configuration files, service logs, and secrets stored with SYSTEM/Administrator-only ACLs — by querying the provider directly.
- Product
- Symantec IT Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Kirby is an open-source content management system.CVE-2026-45368 · Other software · getkirby · reported by GitHubHigh 8.4
Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers that produce `<a href="…">` output from editor-supplied field values: the (`link: …)` KirbyTag, the `link`: parameter of the `(image: …)` KirbyTag when it does not resolve to a known file or `self`, the `link` field of the built-in image block, and the HTML importer for the `blocks` field (which accepted the same malicious input as the image block `link` field). While simple `avascript:` URLs were already deactivated by treating them as a relative path and prepending a single slash to the URL, the use of URLs of the format `javascript://x%0A…` bypasses this protection. The `vbscript:`, `data:`, `livescript:`, `mocha:` and `jar:` schemes are affected by the same underlying gap. This issue has been fixed in versions 4.9.1 and 5.4.1.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Kirby is an open-source content management system.CVE-2026-45334 · Other software · getkirby · reported by GitHubMedium 5.3
Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content-locking feature returned lock information without checking the requesting user's access permissions. Kirby's Panel includes a content-locking feature that records which user currently has a model open for editing. This lock prevents conflicting edits by multiple users and displays the locking user's identity in the Panel UI so other users know who to contact. Internally, the locking user's email address and identifier are included in every Panel view payload and in error responses returned when a user attempts to edit a model that is currently locked by another user. This allowed a low-privilege authenticated Panel user, whose role was configured with users.access: false or users.list: false, to learn the email address and identifier of any user who currently had a model open for editing in the Panel, including administrators and other higher-privilege users. Content locks are active for a configurable window (10 minutes by default). The email address can allow admin account enumeration, target phishing, and feed credential-stuffing attacks against the Kirby installation or other si
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Kirby is an open-source content management system.CVE-2026-44177 · Other software · getkirby · reported by GitHubHigh 8.8
Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resulting in a path traversal vulnerability. Version 5.3.0 introduced a performance improvement to the Users collection that loaded user objects lazily when first needed. Users were queried by their ID, which was then used to locate the corresponding account directory under site/accounts. This affected the authentication API (accessible to unauthenticated requests), the users API (accessible only to authenticated users), and any other place that uses $users->find() to look up an individual user by a request-provided email or ID. As a result, an attacker could trigger arbitrary PHP file inclusion of files named index.php (for example, the main PHP files of plugins), the impact of which depends on the logic those files contain. It also allowed probing for the existence of arbitrary directories on the server, letting attackers fingerprint the server and site setup, including installed plugins and the content structure. This issue has been fixed in version 5.4.1.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Kirby is an open-source content management system.CVE-2026-44176 · Other software · getkirby · reported by GitHubMedium 6
Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the `pages.access` permission during page draft rendering. Permissions are defined for each user role in the user blueprint (site/blueprints/users/...). It is also possible to customize the permissions for each target model in the model blueprints (such as in site/blueprints/pages/...) using the options feature. The permissions and options together control the authorization of user actions. Kirby provides the pages.access and pages.list permissions (among others). The list permission controls whether affected models appear in lists throughout the Panel and REST API. The access permission has the same effect but also disables direct access to the affected models. This vulnerability affects the path resolver for the main CMS router. The resolver takes an input path from the requested URL and determines which model (page or file) should be rendered. When a path is requested that points to a page draft, the resolver checks that the request either contains a valid preview token or is authenticated by a valid user. In affected releases, Kirby allowed page drafts to be rendered if any valid
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Kirby is an open-source content management system.CVE-2026-44175 · Other software · getkirby · reported by GitHubHigh 8.5
Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, Kirby did not securely sanitize the contents of the list field on save, leaving it vulnerable to cross-site scripting (XSS). Kirby's list field stores its formatted content as HTML, and unlike other field types, its HTML special characters cannot be escaped without losing the formatting. Sanitization was only enforced client-side in the Panel, while the server did not sanitize the content on save. As a result, an attacker could bypass the Panel and send malicious HTML directly to Kirby's API, storing unsanitized markup in the content file. That markup would then be rendered on the site frontend and executed in the browsers of site visitors and logged-in users browsing the site, resulting in persistent XSS. This issue has been fixed in versions 4.9.1 and 5.4.1.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Kirby is an open-source content management system.CVE-2026-44174 · Other software · getkirby · reported by GitHubHigh 8.7
Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that were used in its collection queries, allowing attackers to include arbitrary model methods in their queries. This includes methods with sensitive data such as password() (disclosing the password hash) or root() (disclosing the absolute filesystem path on the server) as well as methods that perform impactful actions such as loginPasswordless() (causing a privilege escalation to another user) or delete() (deleting all queried models in one go if the authenticated user has appropriate permissions). This issue has been fixed in versions 4.9.1 and 5.4.1.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authenticated user to conduct an escalation of privilege via local accCVE-2026-53409 · Other software · Zoom Communications · reported by security@zoom.usHigh 7.8
Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Rooms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress.CVE-2026-45336 · Other software · StratonWebDesigners · reported by GitHubCritical 10
HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secret_key used to sign session cookies, allowing unauthenticated attackers who know the public source value to forge cookies containing role=admin and user_id values and bypass authentication. The advisory lists version 1.3 as fixed.
- Product
- HireFlow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026The Janssen Project is an open-source identity and access management (IAM) platform.CVE-2026-45795 · Other software · JanssenProject · reported by GitHubMedium 5.3
The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects because JwtAuthorizationRequest skips inner signature validation when jwe.getSignedJWTPayload() returns null, and AuthzRequestService.processRequestObject() does not reject the unrecognized RSA-OAEP algorithm when forceSignedRequestObject=true. This issue is fixed in version 2.0.0.
- Product
- jans
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrarily trigger a System Management InterrupCVE-2026-10590 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrarily trigger a System Management Interrupt handler.
- Product
- Yoga Pro 7 15IPH11 BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode.CVE-2026-10589 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.8
A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode.
- Product
- Yoga Pro 7 15IPH11 BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory.CVE-2026-10588 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory.
- Product
- Yoga Pro 7 15IPH11 BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode.CVE-2026-10587 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.8
A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode.
- Product
- Yoga Pro 7 15IPH11 BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with AgentCVE-2026-63082 · Other software · Ultimate Fosters · reported by VulnCheckMedium 5.3
Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agent-level privileges to manipulate the Support Agent assignment field of tickets by bypassing intended authorization checks. Attackers can add or remove any user, including Superadmin accounts, from the Support Agent field of any ticket to which they are assigned, circumventing role-based access controls.
- Product
- Perfect Support Ticketing & Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 16, 2026Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability that allows authenticated attackers withCVE-2026-63081 · Other software · Ultimate Fosters · reported by VulnCheckMedium 5.1
Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability that allows authenticated attackers with Agent-level privileges to inject malicious payloads into the Notes field of assigned support tickets. Attackers can store malicious scripts that execute in the browser context of any user who views the affected ticket notes, including Superadmin users, enabling session hijacking or unauthorized actions on behalf of the victim.
- Product
- Perfect Support Ticketing & Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 15, 2026Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript.CVE-2026-55445 · Other software · whyour · reported by GitHubCritical 9.3
Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.
- Product
- qinglong
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling.CVE-2026-30618 · Other software · reported by MITRECritical 9.8
xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulting in execution of arbitrary commands on the server. Successful exploitation allows arbitrary command execution within the context of the Fay service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55.CVE-2026-55398 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 6.9
CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against the server.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55.CVE-2026-33445 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comHigh 8.7
CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol can create a persistent DoS against the server.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.55.CVE-2026-33444 · Other software · Absolute Secutity · reported by SecurityResponse@netmotionsoftware.comMedium 6.9
CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against the server.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55.CVE-2026-33443 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comHigh 7.1
CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol can create a persistent DoS against the server.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026RustFS Console is a web management console for the RustFS distributed file system.CVE-2026-62378 · Other software · rustfs · reported by GitHubCritical 9
RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values. This is caused by a regression of CVE-2026-27822. This vulnerability is fixed in 0.1.10.
- Product
- console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Apollo is a reliable configuration management system suitable for microservice configuration management scenarios.CVE-2026-59955 · Other software · apolloconfig · reported by GitHubHigh 7.5
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under /configfiles/raw/{appId}/{clusterName}/{namespace} are parsed for authentication as appId raw instead of the actual path appId, causing ConfigService to look up AccessKey secrets for raw before verifying the request signature and potentially continue without signature verification for the target appId. This issue is fixed in version 2.5.2.
- Product
- apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Apollo is a reliable configuration management system suitable for microservice configuration management scenarios.CVE-2026-59954 · Other software · apolloconfig · reported by GitHubHigh 7.5
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled because ConfigService can accept a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app, including accent variants under accent-insensitive collations or trailing-space variants under PAD SPACE collations on /configs and /configfiles endpoints. This issue is fixed in version 2.5.2.
- Product
- apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Apollo is a reliable configuration management system suitable for microservice configuration management scenarios.CVE-2025-32781 · Other software · apolloconfig · reported by GitHubMedium 6.5
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId} while configView.memberOnly.envs is enabled, allowing a low-privileged Portal user who obtains or guesses a valid releaseId to read configuration data from other applications and namespaces without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...). This issue is fixed in version 2.5.0.
- Product
- apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Cloudreve is a self-hosted file management and sharing system.CVE-2026-54563 · Other software · cloudreve · reported by GitHubHigh 7.1
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the configured folder and writable credentials to create, overwrite, move, or delete them. This issue is reported as fixed in version 4.16.1.
- Product
- cloudreve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Cloudreve is a self-hosted file management and sharing system.CVE-2026-54562 · Other software · cloudreve · reported by GitHubMedium 6.5
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets, allowing a non-admin user with remote download permission to fetch internal-only URLs and read the response after it is imported into the user's own files. This issue is fixed in version 4.16.1.
- Product
- cloudreve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Cloudreve is a self-hosted file management and sharing system.CVE-2026-54560 · Other software · cloudreve · reported by GitHubHigh 7.6
Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session authentication, allowing a low-scope OAuth access token to call APIs requiring higher scopes such as file, share, workflow, user setting, WebDAV account, and potentially admin scopes. This issue is fixed in version 4.16.1.
- Product
- cloudreve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.