Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8,110 results · page 54 of 163
Feb 23, 2026New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.CVE-2026-25802 · Other software · QuantumNous · reported by GitHubHigh 7.6
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.9, a potential unsafe operation occurs in component `MarkdownRenderer.jsx`, allowing for Cross-Site Scripting(XSS) when the model outputs items containing `<script>` tag. Version 0.10.8-alpha.9 fixes the issue.
- Product
- new-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.CVE-2026-25591 · Other software · QuantumNous · reported by GitHubHigh 7.1
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.10, a SQL LIKE wildcard injection vulnerability in the `/api/token/search` endpoint allows authenticated users to cause denial of service through resource exhaustion by crafting malicious search patterns. The token search endpoint accepts user-supplied `keyword` and `token` parameters that are directly concatenated into SQL LIKE clauses without escaping wildcard characters (`%`, `_`). This allows attackers to inject patterns that trigger expensive database queries. Version 0.10.8-alpha.10 contains a patch.
- Product
- new-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/sCVE-2025-68930 · Other software · traccar · reported by GitHubHigh 7.1
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/socket` endpoint. The application fails to validate the `Origin` header during the WebSocket handshake. This allows a remote attacker to bypass the Same Origin Policy (SOP) and establish a full-duplex WebSocket connection using a legitimate user's credentials (JSESSIONID). As of time of publication, it is unclear whether a fix is available.
- Product
- traccar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0.CVE-2025-70058 · Other software · Ymfe · reported by MITREHigh 7.4
An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in the HTTPS agent configuration for Axios requests
- Product
- Yapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 23, 2026A flaw has been found in FastApiAdmin up to 2.2.0.CVE-2026-2979 · Other software · Fastapiadmin · reported by VulDBLow 2.1
A flaw has been found in FastApiAdmin up to 2.2.0. This issue affects the function user_avatar_upload_controller of the file /backend/app/api/v1/module_system/user/controller.py of the component Scheduled Task API. Executing a manipulation can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.
- Product
- Fastapiadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability was detected in FastApiAdmin up to 2.2.0.CVE-2026-2978 · Other software · Fastapiadmin · reported by VulDBLow 2.1
A vulnerability was detected in FastApiAdmin up to 2.2.0. This vulnerability affects the function upload_file_controller of the file /backend/app/api/v1/module_system/params/controller.py of the component Scheduled Task API. Performing a manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used.
- Product
- Fastapiadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A security vulnerability has been detected in FastApiAdmin up to 2.2.0.CVE-2026-2977 · Other software · Fastapiadmin · reported by VulDBLow 2.1
A security vulnerability has been detected in FastApiAdmin up to 2.2.0. This affects the function upload_controller of the file /backend/app/api/v1/module_common/file/controller.py of the component Scheduled Task API. Such manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
- Product
- Fastapiadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A weakness has been identified in FastApiAdmin up to 2.2.0.CVE-2026-2976 · Other software · Fastapiadmin · reported by VulDBLow 2.1
A weakness has been identified in FastApiAdmin up to 2.2.0. Affected by this issue is the function download_controller of the file /backend/app/api/v1/module_common/file/controller.py of the component Download Endpoint. This manipulation of the argument file_path causes information disclosure. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- Fastapiadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A security flaw has been discovered in FastApiAdmin up to 2.2.0.CVE-2026-2975 · Other software · Fastapiadmin · reported by VulDBMedium 5.5
A security flaw has been discovered in FastApiAdmin up to 2.2.0. Affected by this vulnerability is the function reset_api_docs of the file /backend/app/plugin/init_app.py of the component Custom Documentation Endpoint. The manipulation results in information disclosure. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
- Product
- Fastapiadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability has been found in datapizza-labs datapizza-ai 0.0.2.CVE-2026-2970 · Other software · datapizza-labs · reported by VulDBLow 1.2
A vulnerability has been found in datapizza-labs datapizza-ai 0.0.2. Affected by this vulnerability is the function RedisCache of the file datapizza-ai-cache/redis/datapizza/cache/redis/cache.py. Such manipulation leads to deserialization. The attack requires being on the local network. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- datapizza-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A flaw has been found in datapizza-labs datapizza-ai 0.0.2.CVE-2026-2969 · Other software · datapizza-labs · reported by VulDBLow 2
A flaw has been found in datapizza-labs datapizza-ai 0.0.2. Affected is the function ChatPromptTemplate of the file datapizza-ai-core/datapizza/modules/prompt/prompt.py of the component Jinja2 Template Handler. This manipulation of the argument Prompt causes improper neutralization of special elements used in a template engine. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- datapizza-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026SQL Injection vulnerability in the /api/integrations/getintegrations endpoint of Order Up Online Ordering System 1.0 allows an unauthenticated attacker to accesCVE-2026-24494 · Other software · Order Up · reported by 66fe30d5-b042-4547-a192-c18da4c41a81Critical 9.8
SQL Injection vulnerability in the /api/integrations/getintegrations endpoint of Order Up Online Ordering System 1.0 allows an unauthenticated attacker to access sensitive backend database data via a crafted store_id parameter in a POST request.
- Product
- Online Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.CVE-2026-27193 · Other software · feathersjs · reported by GitHubHigh 8.2
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, all HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients. The OAuth service stores the complete headers object in the session, then the session is persisted using cookie-session, which base64-encodes the data. While the cookie is signed to prevent tampering, the contents are readable by anyone by simply decoding the base64 value. Under specific deployment configurations (e.g., behind reverse proxies or API gateways), this can lead to exposure of sensitive internal infrastructure details such as API keys, service tokens, and internal IP addresses. This issue has been fixed in version 5.0.40.
- Product
- feathers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.CVE-2026-27192 · Other software · feathersjs · reported by GitHubHigh 7.6
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin.The getAllowedOrigin() function checks if the Referer header starts with any allowed origin, and this comparison is insufficient as it only validates the prefix. This is exploitable when the origins array is configured and an attacker registers a domain starting with an allowed origin string (e.g., https://target.com.attacker.com bypasses https://target.com). On its own, tokens are still redirected to a configured origin. However, in specific scenarios an attacker can initiate the OAuth flow from an unauthorized origin and exfiltrate tokens, achieving full account takeover. This issue has bee fixed in version 5.0.40.
- Product
- feathers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.CVE-2026-27191 · Other software · feathersjs · reported by GitHubHigh 7.4
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.39 and below the redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to full account takeover, as the attacker obtains the victim's access token and can impersonate them. The application constructs the final redirect URL by concatenating the base origin with the user-supplied redirect parameter. This is exploitable when the origins array is configured and origin values do not end with /. An attacker can supply @attacker.com as the redirect value results in https://target.com@attacker.com#access_token=..., where the browser interprets attacker.com as the host, leading to full account takeover. This issue has been fixed in version 5.0.40.
- Product
- feathers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026eBay API MCP Server is an open source local MCP server providing AI assistants with comprehensive access to eBay's Sell APIs.CVE-2026-27203 · Other software · YosefHayim · reported by GitHubHigh 8.3
eBay API MCP Server is an open source local MCP server providing AI assistants with comprehensive access to eBay's Sell APIs. All versions are vulnerable to Environment Variable Injection through the updateEnvFile function. The ebay_set_user_tokens tool allows updating the .env file with new tokens. The updateEnvFile function in src/auth/oauth.ts blindly appends or replaces values without validating them for newlines or quotes. This allows an attacker to inject arbitrary environment variables into the configuration file. An attacker can inject arbitrary environment variables into the .env file. This could lead to configuration overwrites, Denial of Service, and potential RCE. There was no fix for this issue at the time of publication.
- Product
- ebay-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2026-27118 · Other software · sveltejs · reported by GitHubMedium 5.3
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users. Successful exploitation requires a victim to visit an attacker-controlled link while authenticated. Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible. This vulnerability is fixed in 6.3.2.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026PROLiNK PRC2402M 20190909 before 2021-06-13 allows live_api.cgi?page=satellite_list OS command injection via shell metacharacters in the ip parameter (for satelCVE-2021-35402 · Other software · PROLiNK · reported by MITRECritical 10
PROLiNK PRC2402M 20190909 before 2021-06-13 allows live_api.cgi?page=satellite_list OS command injection via shell metacharacters in the ip parameter (for satellite_status).
- Product
- PRC2402M
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026An integer underflow vulnerability is present in Silicon Lab’s implementation of PSA Crypto and SE Manager EC-JPAKE APIs during ZKP parsing.CVE-2025-14547 · Other software · silabs.com · reported by product-security@silabs.comLow 2.3
An integer underflow vulnerability is present in Silicon Lab’s implementation of PSA Crypto and SE Manager EC-JPAKE APIs during ZKP parsing. Triggering the underflow can lead to a hard fault, causing a temporary denial of service.
- Product
- Simplicity SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs.CVE-2026-26964 · Other software · windmill-labs · reported by GitHubLow 2.7
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. The GET /api/w/{workspace}/workspaces/get_settings endpoint returns the slack_oauth_client_secret to any authenticated workspace member, regardless of their admin status. It is expected behavior for non-admin users see a redacted version of workspace settings, as some of them are necessary for the frontend to behave correctly even for non-admins. However, the Slack configuration should not be visible to non-admins. This is a legacy issue where the setting was stored as a plain value instead of using $variable indirection, and it was never added to the redaction logic. This issue has been fixed in version 1.635.0.
- Product
- windmill
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives.CVE-2026-26958 · Other software · FiloSottile · reported by GitHubLow 1.7
filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.
- Product
- filippo.io/edwards25519
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering.CVE-2025-15562 · Other software · NesterSoft Inc. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.1
The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker.
- Product
- WorkTime (on-prem/cloud)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries.CVE-2025-15560 · Other software · NesterSoft Inc. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.8
An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data.
- Product
- WorkTime (on-prem/cloud)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime.CVE-2025-15559 · Other software · NesterSoft Inc. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.8
An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.
- Product
- WorkTime (on-prem/cloud)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API.CVE-2025-13590 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Critical 9.1
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.
- Product
- WSO2 API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Feb 18, 2026In the Linux kernel, the following vulnerability has been resolved: hfs: ensure sb->s_fs_info is always cleaned up When hfs was converted to the new mount apiCVE-2025-71230 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: hfs: ensure sb->s_fs_info is always cleaned up When hfs was converted to the new mount api a bug was introduced by changing the allocation pattern of sb->s_fs_info. If setup_bdev_super() fails after a new superblock has been allocated by sget_fc(), but before hfs_fill_super() takes ownership of the filesystem-specific s_fs_info data it was leaked. Fix this by freeing sb->s_fs_info in hfs_kill_super().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 18, 2026An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get.CVE-2026-2329 · Other software · Grandstream · reported by cve@rapid7.comCritical 9.3
An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.
- Product
- GXP1610
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfirmware.grandstream.comgithub.com
Feb 18, 2026Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in CVE-2026-1441 · Other software · Graylog · reported by cve-coordination@incibe.esMedium 5.3
Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker to inject and execute arbitrary JavaScript code when a user visits a specially crafted URL. Exploitation of this vulnerability may allow script execution in the victim's browser and limited manipulation of the affected user's session context, through the '/system/index_sets/' endpoint.
- Product
- Graylog Web Interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in CVE-2026-1440 · Other software · Graylog · reported by cve-coordination@incibe.esMedium 5.3
Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker to inject and execute arbitrary JavaScript code when a user visits a specially crafted URL. Exploitation of this vulnerability may allow script execution in the victim's browser and limited manipulation of the affected user's session context, through the '/system/pipelines/' endpoint.
- Product
- Graylog Web Interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in CVE-2026-1439 · Other software · Graylog · reported by cve-coordination@incibe.esMedium 5.3
Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker to inject and execute arbitrary JavaScript code when a user visits a specially crafted URL. Exploitation of this vulnerability may allow script execution in the victim's browser and limited manipulation of the affected user's session context, through the '/ alerts /' endpoint.
- Product
- Graylog Web Interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in CVE-2026-1438 · Other software · Graylog · reported by cve-coordination@incibe.esMedium 5.3
Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker to inject and execute arbitrary JavaScript code when a user visits a specially crafted URL. Exploitation of this vulnerability may allow script execution in the victim's browser and limited manipulation of the affected user's session context, through the '/system/nodes/' endpoint.
- Product
- Graylog Web Interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in CVE-2026-1437 · Other software · Graylog · reported by cve-coordination@incibe.esMedium 5.3
Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker to inject and execute arbitrary JavaScript code when a user visits a specially crafted URL. Exploitation of this vulnerability may allow script execution in the victim's browser and limited manipulation of the affected user's session context, through the '/system/authentication/users/edit/' endpoint.
- Product
- Graylog Web Interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL.CVE-2026-1436 · Other software · Graylog · reported by cve-coordination@incibe.esHigh 7.1
Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user's profiles without proper authorization checks. Exploiting this vulnerability allows valid users of the system to be listed and sensitive third-party information to be accessed, such as names, email addresses, internal identifiers, and last activity. The endpoint 'http://<IP>:12900/users/<my_user>' does not implement object-level authorization validations.
- Product
- Graylog Web Interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery CVE-2026-1670 · Other software · Honeywell · reported by ics-cert@hq.dhs.govCritical 9.3
The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address.
- Product
- I-HIB2PI-UL 2MP IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026A weakness has been identified in jishi node-sonos-http-api up to 3776f0ee2261c924c7b7204de121a38100a08ca7.CVE-2026-2629 · Other software · jishi · reported by VulDBMedium 5.5
A weakness has been identified in jishi node-sonos-http-api up to 3776f0ee2261c924c7b7204de121a38100a08ca7. Affected is the function Promise of the file lib/tts-providers/mac-os.js of the component TTS Provider. This manipulation of the argument phrase causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- node-sonos-http-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive infoCVE-2026-23598 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.5
Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could allow an attacker to access details such as user accounts, roles, and system configuration, as well as to gain insight into internal services and workflows, increasing the risk of unauthorized access and elevated privileges when combined with other vulnerabilities.
- Product
- HPE Aruba Networking Private 5G Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive infoCVE-2026-23597 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.5
Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could allow an attacker to access details such as user accounts, roles, and system configuration, as well as to gain insight into internal services and workflows, increasing the risk of unauthorized access and elevated privileges when combined with other vulnerabilities.
- Product
- HPE Aruba Networking Private 5G Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts.CVE-2026-23596 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.5
A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability.
- Product
- HPE Aruba Networking Private 5G Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026An authentication bypass in the application API allows an unauthorized administrative account to be created.CVE-2026-23595 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.8
An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability to create privileged user accounts. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
- Product
- HPE Aruba Networking Private 5G Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026SmarterTools SmarterMail before 9526 allows XSS via MAPI requests.CVE-2026-26930 · Other software · SmarterTools · reported by MITREHigh 7.2
SmarterTools SmarterMail before 9526 allows XSS via MAPI requests.
- Product
- SmarterMail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsmartertools.comsmartertools.com
Feb 14, 2026In the Linux kernel, the following vulnerability has been resolved: ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues Add NULL pointer checks in icCVE-2026-23166 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues Add NULL pointer checks in ice_vsi_set_napi_queues() to prevent crashes during resume from suspend when rings[q_idx]->q_vector is NULL. Tested adaptor: 60:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller E810-XXV for SFP [8086:159b] (rev 02) Subsystem: Intel Corporation Ethernet Network Adapter E810-XXV-2 [8086:4003] SR-IOV state: both disabled and enabled can reproduce this issue. kernel version: v6.18 Reproduce steps: Boot up and execute suspend like systemctl suspend or rtcwake. Log: <1>[ 231.443607] BUG: kernel NULL pointer dereference, address: 0000000000000040 <1>[ 231.444052] #PF: supervisor read access in kernel mode <1>[ 231.444484] #PF: error_code(0x0000) - not-present page <6>[ 231.444913] PGD 0 P4D 0 <4>[ 231.445342] Oops: Oops: 0000 [#1] SMP NOPTI <4>[ 231.446635] RIP: 0010:netif_queue_set_napi+0xa/0x170 <4>[ 231.447067] Code: 31 f6 31 ff c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 85 c9 74 0b <48> 83 79 30 00 0f 84 39 01 00 00 55 41 89 d1 49
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 13, 2026PixelYourSite – Your smart PIXEL (TAG) & API Manager: Stored Cross-Site ScriptingCVE-2026-1841 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 11.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2026-27072 is likely a duplicate of this issue.
- Product
- PixelYourSite – Your smart PIXEL (TAG) & API Manager
- Affected
- up to 11.2.0
- What to do
- Affects up to 11.2.0. Update PixelYourSite – Your smart PIXEL (TAG) & API Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 12, 2026Centova Cast 3.2.12 contains a denial of service vulnerability that allows attackers to overwhelm the system by repeatedly calling the database export API endpoCVE-2019-25342 · Other software · Centova Technologies Inc. · reported by VulnCheckHigh 7.1
Centova Cast 3.2.12 contains a denial of service vulnerability that allows attackers to overwhelm the system by repeatedly calling the database export API endpoint. Attackers can trigger 100% CPU load by sending multiple concurrent requests to the /api.php endpoint with crafted parameters.
- Product
- Centova Cast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcentova.comexploit-db.com
Feb 12, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-26185 · Other software · directus · reported by GitHubMedium 5.3
Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk.CVE-2025-55210 · Other software · FreePBX · reported by GitHubLow 2
FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to 17.0.5 and 16.0.17, FreePBX module api (PBX API) is vulnerable to privilege escalation by authenticated users with REST/GraphQL API access. This vulnerability allows an attacker to forge a valid JWT with full access to the REST and GraphQL APIs on a FreePBX that they've already connected to, possibly as a lower privileged user. The JWT is signed using the api-oauth.key private key. An attacker can generate their own token if they possess this key (e.g., by accessing an affected instance), and specify any scopes they wish (e.g., rest, gql), bypassing traditional authorization checks. However, FreePBX enforces that the jti (JWT ID) claim must exist in the database (api_access_tokens table in the asterisk MySQL database) in order for the token to be accepted. Therefore, the attacker must know a jti value that already exists on the target instance. This vulnerability is fixed in 17.0.5 and 16.0.17.
- Product
- api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment.CVE-2026-26217 · Other software · unclecode · reported by VulnCheckCritical 9.2
Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem. An attacker can access sensitive files such as /etc/passwd, /etc/shadow, application configuration files, and environment variables via /proc/self/environ, potentially exposing credentials, API keys, and internal application structure.
- Product
- Crawl4AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment.CVE-2026-26216 · Other software · unclecode · reported by VulnCheckCritical 10
Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.
- Product
- Crawl4AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote coCVE-2026-26215 · Other software · zyddnys · reported by VulnCheckCritical 9.3
manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code execution. The FastAPI endpoints /simple_execute/{method} and /execute/{method} deserialize attacker-controlled request bodies using pickle.loads() without validation. Although a nonce-based authorization check is intended to restrict access, the nonce defaults to an empty string and the check is skipped, allowing remote attackers to execute arbitrary code in the server context by sending a crafted pickle payload.
- Product
- manga-image-translator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchocapikk.comgithub.com
Feb 11, 2026An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the /api/users endpoint.CVE-2024-26478 · Other software · Statping-ng · reported by MITREMedium 5.3
An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the /api/users endpoint.
- Product
- Statping-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth, amazon_sns, export CVE-2024-26477 · Other software · Statping-ng · reported by MITREHigh 7.5
An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth, amazon_sns, export endpoints.
- Product
- Statping-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.