Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
398,769 results · page 567 of 7976
Sep 22, 2026MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).CVE-2026-77243 · Other software · sooperset · reported by GitHubHigh 8.8
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, ENABLED_TOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke excluded read, write, or delete tools despite the operator's configured least-privilege restrictions. The advisory traces the vulnerable input and processing flow through ENABLED_TOOLS, TOOLSETS, tools/list, tools/call, and _call_tool_mcp, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
- Product
- mcp-atlassian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).CVE-2026-77242 · Other software · sooperset · reported by GitHubHigh 7.5
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A caller can use a short-lived DNS answer that is public during validation and private during connection, preserving unauthenticated access to internal or metadata endpoints despite the earlier CVE-2026-27826 remediation. The advisory traces the vulnerable input and processing flow through validate_url_for_ssrf, _check_dns_resolution, socket.getaddrinfo, and _make_ssrf_safe_hook, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
- Product
- mcp-atlassian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the currentCVE-2026-75728 · Other software · Adobe · reported by AdobeCritical 9.1
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
- Product
- Adobe Campaign Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the currentCVE-2026-75723 · Other software · Adobe · reported by AdobeCritical 10
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Campaign Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execuCVE-2026-75721 · Other software · Adobe · reported by AdobeCritical 10
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Campaign Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execuCVE-2026-75703 · Other software · Adobe · reported by AdobeCritical 10
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Campaign Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execuCVE-2026-75699 · Other software · Adobe · reported by AdobeCritical 10
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Campaign Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execuCVE-2026-73369 · Other software · Adobe · reported by AdobeCritical 10
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Campaign Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticateCVE-2026-43643 · Other software · Softaculous · reported by VulnCheckHigh 8.7
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and from_billing_module parameters to the admin panel dispatcher. Attackers can send a POST request with arbitrary uid and balance values in the billing_data field to trigger an unauthenticated parameterized UPDATE against the users table, enabling account balance manipulation and potential automated service suspension for targeted accounts.
- Product
- Virtualizor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvirtualizor.comvirtualizor.com
Sep 22, 2026Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticatedCVE-2026-43642 · Other software · Softaculous · reported by VulnCheckCritical 9.2
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the from_billing_module parameter present. Attackers can pass malicious serialized data through the billing_data POST field to the unserialize() function without allowed_classes restrictions, enabling exploitation of available POP chains to achieve remote code execution as root.
- Product
- Virtualizor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvirtualizor.comvirtualizor.com
Sep 22, 2026Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticateCVE-2026-43641 · Other software · Softaculous · reported by VulnCheckCritical 9.3
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.
- Product
- Virtualizor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvirtualizor.comvirtualizor.com
Sep 22, 2026Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.CVE-2026-18626 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638Medium 6.8
Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 5.0.0 before 5.1.*.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation.CVE-2026-18462 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638High 7.3
Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection.CVE-2026-18461 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638Critical 9.2
Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection. This issue affects Connext Professional: from 7.5.0 before 7.7.0.1, from 7.3.0.10 before 7.3.1.6.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.CVE-2026-18460 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638Medium 6.9
Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality.CVE-2026-18459 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638High 8.7
Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 4.1x before 5.1.*.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI ConnextCVE-2026-18458 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638Medium 6.8
Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.3.0 before 7.3.1.6, from 6.1.2.21 before 6.1.*.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.CVE-2026-18457 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638High 8.3
Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.3 before 5.2.*.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI ConnextCVE-2026-11389 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638Medium 6.8
Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.3.0 before 7.3.1.6.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation.CVE-2026-11388 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638Medium 6.9
Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.1.0 before 7.3.1.6.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt CVE-2026-95818 · Other software · The GNU C Library · reported by 3ff69d7a-14f2-4f67-a097-88dee7810d18Low 3.6
A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.
- Product
- glibc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Sep 22, 2026Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source.CVE-2026-94456 · Other software · GitroomHQ · reported by 4cdc9741-f887-419a-a2fd-acbbd2729276Critical 9.1
Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s deterministic xorshift128+ PRNG state. An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations.
- Product
- postiz-app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgadvisory.orggithub.com
Sep 22, 2026An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session.CVE-2026-94455 · Other software · GitroomHQ · reported by 4cdc9741-f887-419a-a2fd-acbbd2729276High 7.1
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The endpoint's only check is that the request body carries a token bearing a valid signature from the instance secret. It does not check what that token was issued for. Login tokens are signed with the same secret and carry no purpose, audience or expiry claim, so an ordinary user's own session token satisfies the check. Presented with such a token, the endpoint creates a new organisation holding the highest subscription tier, flagged as lifetime and with a channel allowance far above any sold plan, creates an organisation-owner account alongside it, and returns the new organisation's API key in the response body. That key is immediately valid against the public API.
- Product
- postiz-app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgadvisory.orggithub.com
Sep 22, 2026WordPress Core Remote File Inclusion VulnerabilityCVE-2026-87902 · WordPress plugins & themes · reported by support@hackerone.comExploitedHigh 8.1
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.
- Product
- Core
- On CISA’s list since
- Sep 25, 2026 (federal fix deadline Sep 28, 2026)
- What to do
- Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.compatchstack.com
Sep 22, 2026LightRAG provides simple and fast retrieval-augmented generation.CVE-2026-86062 · Other software · HKUDS · reported by GitHubMedium 6.1
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store raw HTML that is returned through the query path and rendered as active content by MessageMarkdown. A user who later retrieves the content can execute attacker-controlled JavaScript through elements such as an iframe srcdoc; the additional Mermaid securityLevel: loose rendering path also injects generated SVG through innerHTML. The script runs in the LightRAG WebUI origin and can read the API token in localStorage and perform API actions as the victim. This issue is fixed in version 1.5.5.
- Product
- LightRAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-86059 · Other software · Dokploy · reported by GitHubCritical 9.6
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider rows without applying getAccessibleGitProviderIds or an organization check. The application.one route also returns nested GitHub, GitLab, Gitea, and Bitbucket relations from findApplicationById with GitHub App private keys, OAuth tokens, client secrets, webhook secrets, and app passwords even when hasGitProviderAccess is false. A member with application read access or a provider identifier can therefore bypass per-member provider assignment and use the exposed credentials to access private repositories or manipulate external workflows. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026LightRAG provides simple and fast retrieval-augmented generation.CVE-2026-85740 · Other software · HKUDS · reported by GitHubHigh 7.1
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.is_global without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A caller who can upload a Markdown or textpack document can supply an external image URL using NAT64 64:ff9b::/96 or an IPv4-compatible form that embeds a loopback, private, or cloud-metadata IPv4 address. On a deployment with compatible NAT64 or DNS64 routing, _download and _build_guarded_opener accept the wrapper and fetch the internal resource, whose body is then ingested. Current interpreter behavior already blocks some RFC 8215 and 6to4 forms, but the fixed guard handles all documented wrappers without becoming more permissive than the standard library. This issue is fixed in version 1.5.5.
- Product
- LightRAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026LightRAG provides simple and fast retrieval-augmented generation.CVE-2026-85734 · Other software · HKUDS · reported by GitHubCritical 9.1
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full request speed until a valid account password is found. Successful credential recovery grants authenticated access to documents, the knowledge graph, and administrative operations. This issue is fixed in version 1.5.5.
- Product
- LightRAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026LightRAG provides simple and fast retrieval-augmented generation.CVE-2026-85725 · Other software · HKUDS · reported by GitHubMedium 5.9
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext AUTH_ACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences based on password length and matching prefixes. A network attacker with sufficiently low-latency access can repeatedly query the /login endpoint and use the timing oracle to recover a plaintext-configured password character by character. Deployments using bcrypt-prefixed password values are not affected by this comparison path. This issue is fixed in version 1.5.5.
- Product
- LightRAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026LightRAG provides simple and fast retrieval-augmented generation.CVE-2026-85709 · Other software · HKUDS · reported by GitHubMedium 5.3
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py. The detail=str(e), detail=str(exc), and equivalent formatted-message paths expose server filesystem paths, database host, port, user, and database names, language-model provider diagnostics, configuration details, and Python library internals to a network client that can trigger an error. The default unauthenticated configuration makes those responses reachable without credentials, and URI-configured backends can disclose connection strings containing credentials depending on the underlying driver error. This issue is fixed in version 1.5.5.
- Product
- LightRAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026FastGPT is an open-source LLM platform for building AI applications on a knowledge base.CVE-2026-84301 · Other software · labring · reported by GitHubMedium 6.3
FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress() before a later HTTP connection performs an independent DNS lookup, creating a DNS rebinding window, allowing an attacker-controlled hostname to resolve publicly during the check and to a loopback, private, link-local, or metadata address during connection. An authenticated attacker who can supply a URL to a safe-Axios-backed HTTP tool, workflow HTTP node, external file fetch, or other server-side integration can use this time-of-check/time-of-use gap to reach services that direct private-address inputs would block. The same independent re-resolution occurs after manual redirect hops because each redirect target is checked before a separate connection lookup. This issue is fixed in version 4.15.2.
- Product
- FastGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Sentry is an error tracking and performance monitoring tool.CVE-2026-83803 · Other software · getsentry · reported by GitHubHigh 7.7
Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes arbitrary code execution in the import worker process. Self-hosted installations using the default configuration are not affected because the relocation feature is disabled by default. This issue is fixed in version 26.7.0.
- Product
- sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Netdata is an open source observability tool.CVE-2026-83603 · Other software · netdata · reported by GitHubHigh 8.4
Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socket_path from the low-privileged netdata service account. The account can direct root fail2ban-client to a malicious UNIX socket, and fail2ban/client/csocket.py CSocket.receive() passes the returned data to pickle.loads(), allowing attacker-controlled code to execute as root on systems with fail2ban-client installed. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.
- Product
- netdata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Netdata is an open source observability tool.CVE-2026-83602 · Other software · netdata · reported by GitHubMedium 6.5
Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, causing unauthenticated PUT requests handled by src/web/api/v3/api_v3_settings.c to bypass operator-configured allow dashboard from IP restrictions. A network-reachable caller can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space, although the file does not control collection or security policy. This vulnerability is fixed in 2.11.0.
- Product
- netdata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Netdata is an open source observability tool.CVE-2026-83601 · Other software · netdata · reported by GitHubMedium 6.5
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded passes to pluginsd_rrddim_put_to_slot in src/plugins.d/pluginsd_internals.h without an upper bound. prd_array_create in src/database/rrdset-pluginsd-array.h can then wrap the size_t allocation calculation while retaining the original large array size, causing the subsequent initialization loop to write beyond the undersized heap allocation and crash the parent agent. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.
- Product
- netdata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Netdata is an open source observability tool.CVE-2026-83600 · Other software · netdata · reported by GitHubMedium 6.5
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot in src/plugins.d/pluginsd_internals.h. The accepted slot drives reallocz to request an approximately 16 GiB chart-pointer array, and allocation failure invokes fatal and aborts the parent Netdata agent, repeatedly disabling centralized monitoring while stream access persists. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.
- Product
- netdata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Netdata is an open source observability tool.CVE-2026-83599 · Other software · netdata · reported by GitHubHigh 7.5
Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocket_client_decompress_message() to grow decompressed output toward WS_MAX_DECOMPRESSED_SIZE without enforcing a compressed-to-decompressed ratio. Small highly compressed frames can therefore cause large server-side allocations, and repeated concurrent connections can exhaust memory and terminate monitoring. This vulnerability is fixed in 2.11.0.
- Product
- netdata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Netdata is an open source observability tool.CVE-2026-83598 · Other software · netdata · reported by GitHubHigh 7.8
Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 from the low-privileged user who initiated repair. Commands placed in that profile before repair therefore execute with SYSTEM privileges. This vulnerability is fixed in 2.10.4.
- Product
- netdata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Nuclei is a vulnerability scanner built on a simple YAML-based DSL.CVE-2026-76805 · Other software · projectdiscovery · reported by GitHubMedium 5.3
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor in one protocol step to be reinterpreted as template syntax in a later fuzz step. This vulnerability is an incomplete fix for CVE-2026-41645: the prior remediation made expressions.Evaluate() single-pass within one call but did not prevent DAST/fuzz callers from evaluating substituted output again. When -env-vars is enabled, a malicious scan target can return marker-shaped content that resolves against the template variable map and discloses scanner-host environment variables such as credentials, API keys, or tokens. The vulnerability requires a multi-step DAST or fuzz template, response data reused through an internal extractor, and explicit environment-variable expansion; users who do not enable -env-vars are not affected by the sensitive-information disclosure. This issue is fixed in version 3.10.0.
- Product
- nuclei
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Nuclei is a vulnerability scanner built on a simple YAML-based DSL.CVE-2026-76804 · Other software · projectdiscovery · reported by GitHubMedium 5.5
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates. The issue affects CLI users running workflows with -w and SDK integrations that accept end-user workflows while relying on the default file-access restriction. This issue is fixed in version 3.10.0.
- Product
- nuclei
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Nuclei is a vulnerability scanner built on a simple YAML-based DSL.CVE-2026-76803 · Other software · projectdiscovery · reported by GitHubMedium 5.3
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an attacker-controlled MySQL-compatible endpoint can cause the server to issue LOAD DATA LOCAL INFILE requests for arbitrary paths, after which the scanner's MySQL client reads the files and returns their contents to the server even though -allow-local-file-access is disabled. JavaScript templates can run unsigned and without the -code flag on affected versions, and the bypass affects CLI and SDK deployments that accept untrusted templates. This issue is fixed in version 3.10.0.
- Product
- nuclei
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Nuclei is a vulnerability scanner built on a simple YAML-based DSL.CVE-2026-76802 · Other software · projectdiscovery · reported by GitHubMedium 4.7
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator enables -dast, an untrusted multiprotocol template can place an unsigned code request into the execution queue and run arbitrary shell commands even without -code or a valid cryptographic signature. The issue affects CLI DAST scans and SDK integrations that enable DAST while accepting attacker-supplied templates. This issue is fixed in version 3.10.0.
- Product
- nuclei
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 20269Router is an AI router & token saver.CVE-2026-56682 · Other software · decolua · reported by GitHubMedium 5.3
9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js for POST /api/auth/login. A remote unauthenticated attacker can rotate the header on every password guess so each request uses a new failed-attempt bucket and the five-attempt progressive lockout never returns HTTP 429. This permits unthrottled password guessing against the dashboard login and can lead to an administrative session if the password is recovered. This issue is fixed in version 0.5.6.
- Product
- 9router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.CVE-2026-95806 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 7.7
MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences: - any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink; - a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user. No component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.
- Product
- MISP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'themiCVE-2026-95805 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 5.3
A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'theming_enabled*' (with a trailing asterisk) instead of the correct 'theming_enabled'. In the MISP ACL system, the array values define which role or permission grants access to a given controller action. The adjacent entry previewEventObjects correctly uses ['theming_enabled'], confirming the intended restriction. The malformed key 'theming_enabled*' does not match any valid permission identifier, causing the access control check for previewEventAttributes to malfunction. Depending on the ACL evaluation logic, this could result in either unauthorized users gaining access to the previewEventAttributes endpoint (authorization bypass) or legitimate users being denied access (availability impact). The previewEventAttributes endpoint exposes event attribute data within MISP so an authorization bypass could expose sensitive indicator and attribute data to users who should not have access.
- Product
- MISP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages.CVE-2026-95655 · Other software · Webkul · reported by VulnCheckHigh 8.6
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.
- Product
- Aureus ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validitCVE-2026-95654 · Other software · David-Crty · reported by VulnCheckCritical 9.1
Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can load the page while pending, then accept the invitation after the legitimate user has already accepted it to overwrite the account password and gain authenticated access to managed database credentials and secrets.
- Product
- Databasement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictCVE-2026-95653 · Other software · concretecms-community-store · reported by VulnCheckHigh 8.7
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.
- Product
- community_store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026A flaw was found in rpcbind.CVE-2026-94640 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 22, 2026Dark Reader is an accessibility browser extension that makes web pages colors dark.CVE-2026-92706 · Other software · darkreader · reported by GitHubLow 3.4
Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like HTTPS URL and is detected as requiring inversion. This behavior can cross the website-to-local-network boundary and disclose limited information associated with the requested resource. The darkreader npm package used for website integration is not affected. This issue is fixed in version 4.9.126 for Firefox and version 4.9.128 for other browsers.
- Product
- darkreader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.