Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8,110 results · page 56 of 163
Jan 22, 2026Moonraker is a Python web server providing API access to Klipper 3D printing firmware.CVE-2026-24130 · Other software · Arksine · reported by GitHubLow 2.7
Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the "ldap" component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes. This issue has been fixed in version 0.10.0.
- Product
- moonraker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Gitea's stopwatch API does not re-validate repository access permissions.CVE-2026-20883 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Medium 6.5
Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.
- Product
- Gitea Open Source Git Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Jan 22, 2026Gitea's notification API does not re-validate repository access permissions when returning notification details.CVE-2026-20800 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Medium 6.5
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.
- Product
- Gitea Open Source Git Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Jan 22, 2026WP MapIt: Missing AuthorizationCVE-2026-22466 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Chandni Patel WP MapIt wp-mapit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP MapIt: from n/a through <= 3.0.3.
- Product
- WP MapIt
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update WP MapIt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Apimo Connector: Missing AuthorizationCVE-2026-22445 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Proptech Plugin Apimo Connector apimo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apimo Connector: from n/a through <= 2.6.5.2.
- Product
- Apimo Connector
- Affected
- up to 2.6.5.2
- What to do
- Affects up to 2.6.5.2. Update Apimo Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026MeetingHub developed by HAMASTAR Technology has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific API functioCVE-2026-1332 · Other software · HAMASTAR Technology · reported by twcert@cert.org.twMedium 6.9
MeetingHub developed by HAMASTAR Technology has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific API functions and obtain meeting-related information.
- Product
- MeetingHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 22, 2026Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WeCVE-2026-24332 · Other software · Discord · reported by MITREMedium 4.3
Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with "status": "offline"), whereas offline users are omitted from the presences array. This is arguably inconsistent with the UI description of Invisible as "You will appear offline." NOTE: a third-party report suggests that this was remediated later in 2026.
- Product
- WebSocket API service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026FastAPI Api Key provides a backend-agnostic library that provides an API key system.CVE-2026-23996 · Other software · Athroniaeth · reported by GitHubLow 3.7
FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks. All users relying on verify_key() for API key authentication prior to the fix are affected. Users should upgrade to version 1.1.0 to receive a patch. The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation. Some workarounds are available. Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied and/or use rate limiting to reduce the feasibility of statistical timing attacks.
- Product
- fastapi-api-key
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints.CVE-2026-23754 · Network & remote access · D-Link · reported by VulnCheckHigh 8.7
D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an arbitrary user_id value to retrieve sensitive credential data belonging to other users, including super administrators. The exposed credential material can be reused directly as a valid authentication secret, allowing full impersonation of the targeted account. This results in complete account takeover and full administrative control over the D-View system.
- Product
- D-View 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.comvulncheck.com
Jan 21, 2026The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence ofCVE-2026-22444 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.1
The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's "allowPaths" security setting https://https://solr.apache.org/guide/solr/latest/configuration-guide/configuring-solr-xml.html#the-solr-element . These read-only accesses can allow users to create cores using unexpected configsets if any are accessible via the filesystem. On Windows systems configured to allow UNC paths this can additionally cause disclosure of NTLM "user" hashes. Solr deployments are subject to this vulnerability if they meet the following criteria: * Solr is running in its "standalone" mode. * Solr's "allowPath" setting is being used to restrict file access to certain directories. * Solr's "create core" API is exposed and accessible to untrusted users. This can happen if Solr's RuleBasedAuthorizationPlugin https://solr.apache.org/guide/solr/latest/deployment-guide/rule-based-authorization-plugin.html is disabled, or if it is enabled but the "core-admin-edit" predefined permission (or an equivalent custom permission)
- Product
- Apache Solr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jan 21, 2026A flaw was found in the Keycloak Admin REST API.CVE-2025-14083 · Other software · Red Hat · reported by Red HatLow 2.7
A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control.
- Product
- Red Hat build of Keycloak 26.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 19, 2026Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.CVE-2026-23947 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in nature to CVE-2026-22785, but affects a different code path in @orval/core that was not addressed by CVE-2026-22785's fix. The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the generated schema files. Orval 7.19.0 and 8.0.2 contain a fix for the issue.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026Mailpit is an email testing tool and API for developers.CVE-2026-23845 · Other software · axllent · reported by GitHubMedium 5.8
Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check feature (`/api/v1/message/{ID}/html-check`) is designed to analyze HTML emails for compatibility. During this process, the `inlineRemoteCSS()` function automatically downloads CSS files from external `<link rel="stylesheet" href="...">` tags to inline them for testing. Version 1.28.3 fixes the issue.
- Product
- mailpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2026Mailpit is an email testing tool and API for developers.CVE-2026-23829 · Other software · axllent · reported by GitHubMedium 5.3
Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class. Version 1.28.3 fixes this issue.
- Product
- mailpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.CVE-2026-22865 · Other software · gradle · reported by GitHubHigh 8.6
Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would continue to the next repository in the list and potentially resolve dependencies from a different repository. An exception like NoHttpResponseException can indicate transient errors. If the errors persist after a maximum number of retries, Gradle would continue to the next repository. This behavior could allow an attacker to disrupt the service of a repository and leverage another repository to serve malicious artifacts. This attack requires the attacker to have control over a repository after the disrupted repository. Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other repositories when encountering these errors.
- Product
- gradle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs.CVE-2026-22816 · Other software · gradle · reported by GitHubHigh 8.6
Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would continue to the next repository in the list and potentially resolve dependencies from a different repository. If a Gradle build used an unresolvable host name, Gradle would continue to work as long as all dependencies could be resolved from another repository. An unresolvable host name could be caused by allowing a repository's domain name registration to lapse or typo-ing the real domain name. This behavior could allow an attacker to register a service under the host name used by the build and serve malicious artifacts. The attack requires the repository to be listed before others in the build configuration. Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other repositories when encountering these errors.
- Product
- gradle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026CakePHP is a rapid development framework for PHP.CVE-2026-23643 · Other software · cakephp · reported by GitHubMedium 5.4
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.
- Product
- cakephp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbakery.cakephp.orggithub.com
Jan 16, 2026wlc is a Weblate command-line client using Weblate's REST API.CVE-2026-23535 · Other software · WeblateOrg · reported by GitHubHigh 8
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.
- Product
- wlc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users toCVE-2025-14435 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.8
Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users to cause application-level DoS via triggering unbounded component re-render loops.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Odine Solutions GateKeeper 1.0 contains a SQL injection vulnerability in the trafficCycle API endpoint that allows remote attackers to inject malicious databaseCVE-2021-47782 · Other software · Odinesolutions · reported by VulnCheckHigh 7.1
Odine Solutions GateKeeper 1.0 contains a SQL injection vulnerability in the trafficCycle API endpoint that allows remote attackers to inject malicious database queries. Attackers can exploit the vulnerability by sending crafted payloads to the /rass/api/v1/trafficCycle/ endpoint to manipulate PostgreSQL database queries and potentially extract sensitive information.
- Product
- Odine Solutions GateKeeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordodine.comexploit-db.com
Jan 15, 2026SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2026-22803 · Other software · sveltejs · reported by GitHubHigh 8.2
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2025-67647 · Other software · sveltejs · reported by GitHubHigh 8.4
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route (export const prerender = true). From 2.19.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route and you are using adapter-node without a configured ORIGIN environment variable, and you are not using a reverse proxy that implements Host header validation. This vulnerability is fixed in 2.49.5.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries.CVE-2021-47763 · Websites & servers · Aimeos · reported by VulnCheckHigh 8.8
Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint.
- Product
- Aimeos Laravel ecommerce platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs.CVE-2026-22240 · Other software · Bluspark Global · reported by 56a186b1-7f5e-4314-ba38-38d5499fccfdCritical 10
The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the plaintext passwords of all user users. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers' data and completely compromise the targeted platform by logging in using an exposed admin email address and password.
- Product
- BLUVOYIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026The vulnerability exists in BLUVOYIX due to design flaws in the email sending API.CVE-2026-22239 · Other software · Bluspark Global · reported by 56a186b1-7f5e-4314-ba38-38d5499fccfdCritical 10
The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable email sending API. Successful exploitation of this vulnerability could allow the attacker to send unsolicited emails to anyone on behalf of the company.
- Product
- BLUVOYIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs.CVE-2026-22238 · Other software · Bluspark Global · reported by 56a186b1-7f5e-4314-ba38-38d5499fccfdCritical 10
The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable admin API to create a new user with admin privileges. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers' data and completely compromise the targeted platform by logging in to the newly-created admin user.
- Product
- BLUVOYIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation.CVE-2026-22237 · Other software · Bluspark Global · reported by 56a186b1-7f5e-4314-ba38-38d5499fccfdCritical 10
The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the APIs exposed by the documentation. Successful exploitation of this vulnerability could allow the attacker to cause damage to the targeted platform by abusing internal functionality.
- Product
- BLUVOYIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs.CVE-2026-22236 · Other software · Bluspark Global · reported by 56a186b1-7f5e-4314-ba38-38d5499fccfdCritical 10
The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable APIs. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers' data and completely compromise the targeted platform.
- Product
- BLUVOYIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user APICVE-2025-71113 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user API contexts and requests allocated with sock_kmalloc() were left uninitialized, relying on callers to set fields explicitly. This resulted in the use of uninitialized data in certain error paths or when new fields are added in the future. The ACVP patches also contain two user-space interface files: algif_kpp.c and algif_akcipher.c. These too rely on proper initialization of their context structures. A particular issue has been observed with the newly added 'inflight' variable introduced in af_alg_ctx by commit: 67b164a871af ("crypto: af_alg - Disallow multiple in-flight AIO requests") Because the context is not memset to zero after allocation, the inflight variable has contained garbage values. As a result, af_alg_alloc_areq() has incorrectly returned -EBUSY randomly when the garbage value was interpreted as true: https://github.com/gregkh/linux/blame/master/crypto/af_alg.c#L1209 The check directly tests ctx->inflight without explicitly comparing against true/false. Since inflight is only ever set to true or false l
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 13, 2026Emerson PAC Machine Edition 9.80 contains an unquoted service path vulnerability in the TrapiServer service that allows local users to potentially execute code CVE-2022-50930 · Other software · Emerson · reported by VulnCheckHigh 8.5
Emerson PAC Machine Edition 9.80 contains an unquoted service path vulnerability in the TrapiServer service that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious code that would execute with LocalSystem permissions during service startup.
- Product
- Emerson PAC Machine Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordemerson.comexploit-db.com
Jan 13, 2026An issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a crafted HTTP request to various API endpoints.CVE-2025-66698 · Other software · Semantic-machines · reported by MITREHigh 8.6
An issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a crafted HTTP request to various API endpoints.
- Product
- Veda
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions tCVE-2025-13447 · Other software · Progress Software · reported by security@progress.comHigh 8.4
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
- Product
- LoadMaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comcommunity.progress.com
Jan 13, 2026OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions tCVE-2025-13444 · Other software · Progress Software · reported by security@progress.comHigh 8.4
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
- Product
- LoadMaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comcommunity.progress.com
Jan 13, 2026Affected devices do not properly enforce user authentication on specific API endpoints.CVE-2025-40805 · Other software · Siemens · reported by productcert@siemens.comCritical 10
Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has learned the identity of a legitimate user.
- Product
- Industrial Edge Cloud Device (IECD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jan 12, 2026Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the quCVE-2023-36331 · Other software · Exrick · reported by MITREHigh 8.2
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.
- Product
- Xmall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.CVE-2026-22785 · Other software · orval-labs · reported by GitHubCritical 9.3
orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without proper validation or escaping. This allows an attacker to "break out" of the string literal and inject arbitrary code. This vulnerability is fixed in 7.18.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026wlc is a Weblate command-line client using Weblate's REST API.CVE-2026-22251 · Other software · WeblateOrg · reported by GitHubMedium 5.3
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.
- Product
- wlc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026wlc is a Weblate command-line client using Weblate's REST API.CVE-2026-22250 · Other software · WeblateOrg · reported by GitHubLow 2.5
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.
- Product
- wlc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2026HarfBuzz is a text shaping engine.CVE-2026-22693 · Other software · harfbuzz · reported by GitHubMedium 5.3
HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.
- Product
- harfbuzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2026Mailpit is an email testing tool and API for developers.CVE-2026-22689 · Other software · axllent · reported by GitHubMedium 6.5
Mailpit is an email testing tool and API for developers. Prior to version 1.28.2, the Mailpit WebSocket server is configured to accept connections from any origin. This lack of Origin header validation introduces a Cross-Site WebSocket Hijacking (CSWSH) vulnerability. An attacker can host a malicious website that, when visited by a developer running Mailpit locally, establishes a WebSocket connection to the victim's Mailpit instance (default ws://localhost:8025). This allows the attacker to intercept sensitive data such as email contents, headers, and server statistics in real-time. This issue has been patched in version 1.28.2.
- Product
- mailpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users.CVE-2025-67811 · Other software · Area9lyceum · reported by MITREMedium 6.5
Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. Insufficient input validation allows remote attackers to inject arbitrary SQL commands, resulting in unauthorized database access and potential compromise of sensitive data. Fixed in v.1.47.4 and beyond.
- Product
- Rhapsode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarea9.comsecurity.area9lyceum.com
Jan 9, 2026GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality.CVE-2026-22198 · Other software · GestSup · reported by VulnCheckMedium 5.1
GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value (for example, to /api/v1/ticket.php), an unauthenticated attacker can cause attacker-controlled HTML/JavaScript to be written to log entries. When an administrator later views the affected logs in the web interface, the injected content is rendered without proper output encoding, resulting in arbitrary script execution in the administrator’s browser session.
- Product
- GestSup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgestsup.frvulncheck.com
Jan 9, 2026Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs.CVE-2026-20970 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.8
Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jan 8, 2026Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs ExteCVE-2026-22712 · Other software · The Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccLow 2.3
Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39.
- Product
- Mediawiki - ApprovedRevs Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Jan 8, 2026Directus is a real-time API and App dashboard for managing SQL database content.CVE-2026-22032 · Other software · directus · reported by GitHubMedium 4.3
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the `RelayState` parameter is intended to preserve the user's original destination. However, while the login initiation flow validates redirect targets against allowed domains, this validation is not applied to the callback endpoint. This allows an attacker to craft a malicious authentication request that redirects users to an arbitrary external URL upon completion. The vulnerability is present in both the success and error handling paths of the callback. This vulnerability can be exploited without authentication. Version 11.14.0 contains a patch.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Mailpit is an email testing tool and API for developers.CVE-2026-21859 · Other software · axllent · reported by GitHubMedium 5.8
Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability in the /proxy endpoint, allowing attackers to make requests to internal network resources. The /proxy endpoint validates http:// and https:// schemes, but it does not block internal IP addresses, enabling attackers to access internal services and APIs. This vulnerability is limited to HTTP GET requests with minimal headers. The issue is fixed in version 1.28.1.
- Product
- mailpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026ACF to REST API: Insecure Direct Object ReferenceCVE-2025-12030 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ACF to REST API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.4. This is due to insufficient capability checks in the update_item_permissions_check() method, which only verifies that the current user has the edit_posts capability without checking object-specific permissions (e.g., edit_post($id), edit_user($id), manage_options). This makes it possible for authenticated attackers, with Contributor-level access and above, to modify ACF fields on posts they do not own, any user account, comments, taxonomy terms, and even the global options page via the /wp-json/acf/v3/{type}/{id} endpoints, granted they can authenticate to the site.
- Product
- ACF to REST API
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update ACF to REST API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2026Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023CVE-2025-11235 · Other software · Progress · reported by security@progress.comLow 3.7
Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026Lack of output escaping leads to a XSS vector in the pagebreak plugin.CVE-2025-63083 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of output escaping leads to a XSS vector in the pagebreak plugin.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-sCVE-2020-36905 · Other software · FIBAR GROUP S.A. · reported by VulnCheckMedium 5.1
FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-side scripts. Attackers can exploit the 'url' GET parameter to inject malicious JavaScript and potentially hijack user sessions or manipulate page content.
- Product
- Home Center 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.