Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
398,071 results · page 516 of 7962
Sep 25, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-63006 · Other software · zammad · reported by GitHubMedium 5.3
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected API endpoint and sends the request with the agent's session cookie, enabling side effects such as forced logout without any user interaction. This issue is fixed in version 7.1.2.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-61855 · Other software · zammad · reported by GitHubMedium 5.3
Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid ("Good") PGP signature from a registered sender key, even though the displayed message content is not actually covered by that signature. As a result, the inbound article may be stored with a successful signature status that does not reflect the authenticity of the shown content. This can mislead agents who rely on the signature indicator when assessing the trustworthiness of incoming mail. This issue is fixed in version 7.1.2.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-55217 · Other software · glpi-project · reported by GitHubMedium 5.3
GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0.8 and 10.0.26.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-55214 · Other software · glpi-project · reported by GitHubHigh 8.5
GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-53629 · Other software · glpi-project · reported by GitHubHigh 7.1
GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-53628 · Other software · glpi-project · reported by GitHubMedium 5.9
GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The affected user-account administration flow did not consistently enforce the target user's entity-scoped update permission. This issue is fixed in versions 11.0.8 and 10.0.26.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-53627 · Other software · glpi-project · reported by GitHubMedium 6
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable authorization checks. This issue is fixed in version 11.0.8.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-53626 · Other software · glpi-project · reported by GitHubHigh 7.1
GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to read a document linked to an inaccessible item. This issue is fixed in version 11.0.8.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-53625 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a super-administrator's authentication method and enable account takeover. This issue is fixed in versions 11.0.8 and 10.0.26.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-53610 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. This issue is fixed in version 11.0.8.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-49470 · Other software · glpi-project · reported by GitHubHigh 7.7
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. This issue is fixed in version 11.0.8.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-49469 · Other software · glpi-project · reported by GitHubMedium 4.6
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-48482 · Other software · glpi-project · reported by GitHubCritical 9.4
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location, allowing a malicious script to be invoked remotely. This issue is fixed in version 11.0.8.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-47679 · Other software · glpi-project · reported by GitHubHigh 8.5
GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions 11.0.8 and 10.0.26.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-45801 · Other software · glpi-project · reported by GitHubMedium 5.3
GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue is fixed in versions 11.0.8 and 10.0.26.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end.CVE-2026-100306 · Other software · TDuckCloud · reported by VulnCheckMedium 6.9
TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links.
- Product
- tduck-survey-form
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/form/data/create.CVE-2026-100305 · Other software · TDuckCloud · reported by VulnCheckMedium 5.3
TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/form/data/create. Authenticated attackers who know a form's key can submit unlimited entries to any form, bypassing publish status, time window, quota, and per-IP restrictions to falsify collected results.
- Product
- tduck-survey-form
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing autheCVE-2026-100304 · Other software · TDuckCloud · reported by VulnCheckMedium 6
TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providing a known dataId to the GET /user/form/data/details endpoint after the form has been permanently deleted.
- Product
- tduck-survey-form
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories.CVE-2026-100303 · Other software · TDuckCloud · reported by VulnCheckMedium 5.3
TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories. Authenticated non-admin users can add, modify, or delete themes and theme categories affecting forms owned by other users.
- Product
- tduck-survey-form
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering.CVE-2026-100192 · Other software · yzcheng90 · reported by VulnCheckMedium 6.9
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.
- Product
- X-SpringBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be.CVE-2026-97886 · Other software · mathurvishal · reported by VulDBLow 2.1
A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file managevideos2.php. Such manipulation of the argument editassid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CloudClassroom-PHP-Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be.CVE-2026-97885 · Other software · mathurvishal · reported by VulDBMedium 5.5
A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updatefaculty.php. This manipulation of the argument fid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CloudClassroom-PHP-Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be.CVE-2026-97884 · Other software · mathurvishal · reported by VulDBLow 2.1
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatestudent.php of the component Student Update Functionality. The manipulation of the argument eno results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CloudClassroom-PHP-Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be.CVE-2026-97883 · Other software · mathurvishal · reported by VulDBMedium 5.5
A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. The manipulation of the argument gid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CloudClassroom-PHP-Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be.CVE-2026-97882 · Other software · mathurvishal · reported by VulDBMedium 5.5
A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file loginlinkfaculty.php of the component Faculty Authentication. Executing a manipulation of the argument fid/pass can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CloudClassroom-PHP-Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media fileCVE-2026-93366 · Other software · Bludit · reported by VulnCheckMedium 5.3
Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid parameters to unprotected AJAX endpoints. Attackers can retrieve page UUIDs for all users via the content-get-list endpoint and then submit crafted POST requests to the list-images and delete-image endpoints in bl-kernel/ajax/ to access and destroy media files outside their own pages, bypassing the IMAGE_RESTRICT isolation control.
- Product
- Bludit CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvulncheck.com
Sep 25, 2026A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager.CVE-2026-91841 · Other software · GNOME · reported by patrick@puiterwijk.orgHigh 7.8
A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege escalation.
- Product
- NetworkManager-vpnc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 25, 2026A flaw was found in NetworkManager-vpnc.CVE-2026-91840 · Other software · GNOME · reported by patrick@puiterwijk.orgHigh 7.8
A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when the malicious VPN connection is activated.
- Product
- NetworkManager-vpnc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 25, 2026A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager.CVE-2026-91839 · Other software · GNOME · reported by patrick@puiterwijk.orgHigh 7.8
A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF) characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile to inject additional configuration directives. This can lead to arbitrary code execution with root privileges when the crafted VPN connection is activated.
- Product
- NetworkManager-fortisslvpn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 25, 2026A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager.CVE-2026-91838 · Other software · GNOME · reported by patrick@puiterwijk.orgHigh 7.8
A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped characters are then processed by the `pppd` daemon, which runs with root privileges, allowing the attacker to execute arbitrary commands with elevated permissions when a malicious VPN connection is activated.
- Product
- NetworkManager-sstp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 25, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-84462 · Other software · zammad · reported by GitHubHigh 8.6
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypassed by entering specially crafted text into one of an AI Agent's fields. An administrator with permission to create or edit AI Agents could exploit this to run arbitrary commands on the server that hosts Zammad, potentially reading, modifying, or destroying all data stored on that server. No interaction from other users is needed; the malicious code runs automatically the next time the affected AI Agent processes a ticket. This issue is fixed in version 7.1.2.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-65828 · Other software · zammad · reported by GitHubLow 2.3
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroy_form action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied form_id without verifying that the requesting user owns those records. An authenticated attacker who learns another user's pending-upload UUID can silently remove temporary file uploads before the victim submits their ticket or article. This issue is fixed in version 7.1.2.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-61525 · Other software · zammad · reported by GitHubHigh 8.8
Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficiently validated before being used to construct internal file paths. When the file-based session store is active (the default configuration), an authenticated attacker can manipulate the session identifier to reference locations outside the intended storage directory, leading to the deletion of arbitrary files and directories on the server. Exploitation requires only a low-privilege authenticated session and a single crafted request. Instances configured to use the Redis-based session store are not affected. This issue is fixed in versions 7.0.3 and 7.1.1.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-56735 · Other software · zammad · reported by GitHubMedium 5.3
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer (HtmlSanitizer::Strict) blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight allows an attacker to embed arbitrary external URLs in the srcset attribute just by sending an e-mail, effectively bypassing the external content protection. When an agent views the ticket containing the malicious srcset, the browser will silently load the attacker-controlled URL, resulting in the leakage of the agent's IP address, User-Agent, Referer, and the exact time the ticket was viewed. HtmlSanitizer::Strict got extended to block external URLs in the srcset attribute of tags. This was done to prevent tracking pixels and external content loading, which could compromise user privacy. This issue is fixed in versions 7.0.2 and 7.1.0.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-56734 · Other software · zammad · reported by GitHubMedium 5.3
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication (OAuth/OIDC/SAML), a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider may cause the server to connect to internal network locations. Response timing and error patterns differ between reachable and unreachable targets, allowing internal service probing. Worker processes may be blocked for several seconds per request. Requires a configured external authentication provider where the actor can modify their profile image URL. This issue is fixed in version 7.0.2.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-56733 · Other software · zammad · reported by GitHubHigh 8.7
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions during the initialization of new identity objects exhibits a discrepancy: Under specific conditions, the granular restrictions of the access key being used are overridden by the latent authorization authority of the parent account. Consequently, this means that the intended separation of functional areas is nullified, resulting in an uncontrolled expansion of administrative discretion. Due to this potential integrity breach of the entire trust environment, an immediate evaluation of the authorization hierarchies is imperative. Impact An attacker can create new administrator accounts despite token restrictions. This grants full access to all system data (tickets, customers, configuration) and allows the attacker to take complete control of the Zammad instance. Abuse Scenario The vulnerability stems from a lack of synergy between the token-based authorization logic and the target system's functional authorization hierarchy, whic
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-56732 · Other software · zammad · reported by GitHubMedium 5.3
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can trigger a logout request, terminating the viewer's session. This vulnerability is fixed in 7.0.2.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-56731 · Other software · zammad · reported by GitHubHigh 8.4
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization. This issue is fixed in version 7.0.1.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-56730 · Other software · zammad · reported by GitHubLow 2.1
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable GraphQL mutation is meant to transform a knowledge base answer suggestion so it can be inserted into the ticket editor, but it only checks if the user has the ticket.agent permission. Checking the authorization to the knowledge base answer itself is missing. This vulnerability is fixed in 7.0.2.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-56728 · Other software · zammad · reported by GitHubMedium 5.3
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with the target user's taskbar identifier. The taskbar feature stores transient state for active user sessions, including auto-saved ticket drafts. Under certain conditions, the authorization check for taskbar item access is not enforced, allowing a user to read another user's taskbar item data. This vulnerability is fixed in 7.0.2.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-56727 · Other software · zammad · reported by GitHubHigh 7.1
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler unconditionally wrote sign: { success: true, comment: "Good signature" } to the article's security preferences. Impact Any sender could tamper with the body of a multipart/signed PGP email, or craft a message with an entirely fabricated or mismatched signature, and Zammad would display it to the recipient as cryptographically verified with a "Good signature" label. Users and agents relying on Zammad's signature indicator to confirm message authenticity and integrity would be misled into trusting modified or forged content. The vulnerability affects all inbound PGP-signed emails processed while the PGP integration is enabled. This issue is fixed in version 7.0.2.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-56726 · Other software · zammad · reported by GitHubMedium 5.1
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of GitHub/GitLab issues attached to any ticket in the system. This allows an internal user to systematically view GitHub/GitLab issue data linked by other agents or administrators across the organization by simply querying random or sequential ticket IDs. This vulnerability is fixed in 7.0.2.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Zammad is a web based open source helpdesk/customer support system.CVE-2026-56725 · Other software · zammad · reported by GitHubHigh 8.7
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/import_check blocks a Zammad request worker for roughly two minutes. The import_check and import_status actions are missing the setup_done_response guard that other actions in the same controller carry, so they execute on fully set-up production instances. The action enters a retry loop against a blank OTRS endpoint, sleeping for 30 s + 45 s between attempts. Impact An unauthenticated remote attacker denies service to a production Zammad instance. Each request costs almost nothing and forces ~115 seconds of server-side blocking. A few requests per second saturate the Puma worker pool. The condition persists as long as the traffic continues. No account, valid import configuration, or target knowledge beyond the hostname is needed. CSRF token is trivially obtained from any prior GET response. This issue is fixed in version 7.0.2.
- Product
- zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1.CVE-2026-97879 · Other software · zhistaredu · reported by VulDBMedium 5.5
A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- StarTraining
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026A vulnerability was identified in zhistaredu StarTraining up to 3.8.1.CVE-2026-97878 · Other software · zhistaredu · reported by VulDBMedium 5.5
A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Impacted is the function anonymous of the file /druid/index.html of the component Druid Console. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- StarTraining
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026A vulnerability was determined in zhistaredu StarTraining up to 3.8.1.CVE-2026-97877 · Other software · zhistaredu · reported by VulDBMedium 5.5
A vulnerability was determined in zhistaredu StarTraining up to 3.8.1. This issue affects the function UserLoginService.createToken of the file application.yml of the component JWT Token Handler. This manipulation of the argument user_id/company_id causes use of hard-coded password. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- StarTraining
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76.CVE-2026-97871 · Other software · Zhonglun · reported by VulDBMedium 5.5
A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the component JSBridge. Such manipulation of the argument url leads to code injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CloudPos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtaiCVE-2026-95835 · Other software · Kovid Goyal · reported by 4daa8cea-433a-44bd-9456-53b127fc289aMedium 5.6
Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handle_remote_askpass() in kitty/window.py opens the POSIX shared memory object named in the escape code, parses a prompt definition out of it, and writes the user's answer back into an object of that same name, without at any point checking that the object is owned by the user running kitty or that its permissions exclude other users. The equivalent consumer of the same SharedMemory class in the ssh kitten performs exactly that check; the askpass path did not. The handler is reached through a device control string processed from the byte stream of the window, so the attacker must also cause bytes of their choosing to be displayed by the victim's terminal. Where the POSIX shared memory namespace is shared between the two users, a second local user can create an object with permissions that allow the victim to read and write it, cause the victim's kitty to render a prompt of the attacker's choosing, including a masked password prompt, and read the typed secret
- Product
- kitty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the teCVE-2026-95834 · Other software · Kovid Goyal · reported by 4daa8cea-433a-44bd-9456-53b127fc289aMedium 4.6
Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag_remote_file_data() in kitty/dnd.c holds a DragRemoteItem pointer into an array it does not own, calls toplevel_data_for_drag() or subdir_data_for_drag(), and then continues to use that pointer. Those helpers, and add_payload() and populate_dir_entries() which they call, report errors through the abrt() macro, which expands to cancel_drag() followed by a plain return, and cancel_drag() calls drag_free_offer(), which frees the array the pointer refers to. The helpers return void, so the caller receives no indication that the teardown happened, and proceeds to call all_children_complete() on the freed pointer, which dereferences it, and then to write through it. That dereference is guarded by a local flag that is set when the request carries no payload and announces no further data, which is the same condition that selects the finalisation block of add_payload(), so the error paths in that block reach it: a create that fails because an entry of the same name alrea
- Product
- kitty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem.CVE-2026-94445 · Other software · golang.org/x/playground · reported by security@golang.orgHigh 8.8
A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host's $HOME. Together, a well-crafted go env file and the go vet invocation could lead to remote code execution in the playground host itself. This does not affect users of go.dev/play directly; however, it may affect independent deployments of golang.org/x/playground.
- Product
- golang.org/x/playground
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.