Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,292 results · page 57 of 346
Jun 26, 2026OpenProject is open-source, web-based project management software.CVE-2026-47193 · Other software · opf · reported by GitHubHigh 7.5
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026OpenProject is open-source, web-based project management software.CVE-2026-46386 · Other software · opf · reported by GitHubCritical 9.9
OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, this gives any logged-in user a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader This vulnerability is fixed in .
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026OpenProject is open-source, web-based project management software.CVE-2026-44736 · Other software · opf · reported by GitHubMedium 6.5
OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission to view — by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026OpenProject is open-source, web-based project management software.CVE-2026-44735 · Other software · opf · reported by GitHubMedium 6.5
OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the view_shared_work_packages permission. The authorization check operates at the project level only — it does not verify the requesting user can actually view each individual shared work package. This allows a regular project member to discover work package IDs and subjects (including confidential titles), which users have been granted shared access, what role level was assigned (Editor, Commenter, Viewer). This vulnerability is fixed in 17.3.2 and 17.4.0.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026OpenProject is open-source, web-based project management software.CVE-2026-44734 · Other software · opf · reported by GitHubMedium 6.5
OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization vulnerability exists in OpenProject's CostReportsController. The rename and update actions allow any authenticated user to modify the name, filters, and grouping of any Public cost report in the system without verifying ownership or permission level. An attacker who discovers or guesses a public report's numeric ID can rename or overwrite its filter configuration without any warning to the report's owner. This vulnerability is fixed in 17.3.2 and 17.4.0.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026OpenProject is open-source, web-based project management software.CVE-2026-44733 · Other software · opf · reported by GitHubMedium 5.9
OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements. A password validation flaw in the change password behavior allows attackers to change a user's password only with an active session takeover. This vulnerability is fixed in 17.3.2 and 17.4.0.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026OpenProject is open-source, web-based project management software.CVE-2026-44732 · Other software · opf · reported by GitHubMedium 4.3
OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, OpenProject exposes a document update endpoint used to modify existing documents. The target document is loaded with visibility checks and then updated. During update, attacker-controlled attributes are applied to the persisted record before authorization is enforced. As a result, a user without :manage_documents in the source project can move and modify foreign project documents by setting project_id in a single PATCH request. This vulnerability is fixed in 17.3.2 and 17.4.0.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026OpenProject is open-source, web-based project management software.CVE-2026-44731 · Other software · opf · reported by GitHubMedium 4.3
OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the web application's meetings filter feature leaks whether a given user ID corresponds to a valid account and discloses the user's full name, allowing an attacker to enumerate all existing user accounts by probing user IDs and observing differences in the server response. This vulnerability is fixed in 17.3.2 and 17.4.0.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026OpenProject is open-source, web-based project management software.CVE-2026-44696 · Other software · opf · reported by GitHubMedium 5.7
OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text (markdown) rendering pipeline uses Sanitize::Config::RELAXED[:css] for inline style sanitization. This configuration permits essentially all CSS properties in style attributes on permitted HTML elements (figure, img, table, th, tr, td). This allows any authenticated user with write access to formattable text fields (work package descriptions, comments, project descriptions, news) to inject CSS This vulnerability is fixed in 17.4.0.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.CVE-2026-56034 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts.CVE-2026-57913 · Other software · Johnson & Johnson · reported by MITREHigh 7.5
Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts.
- Product
- Audit Tracking Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026FOSSBilling is a free, open-source billing and client management system.CVE-2026-43920 · Other software · FOSSBilling · reported by GitHubMedium 6.9
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.4 through 0.7.2, the /run-patcher maintenance endpoint in FOSSBilling was accessible without authentication, which allowed unauthenticated remote users to trigger update patch routines that modify configuration files, execute database schema changes, perform filesystem mutations, and clear caches. The /run-patcher endpoint executes privileged maintenance operations - configuration migrations, database patch execution (including ALTER TABLE, DROP TABLE, UPDATE statements), filesystem deletions and renames, and cache clearing - without requiring administrator authentication, CSRF validation, or CLI context. An unauthenticated remote attacker can trigger these operations by sending a simple HTTP GET request to /run-patcher, which can be abused for denial-of-service attacks. Certain patches (e.g., batch token regeneration for all admin and client accounts in patch 53, and session invalidation) are disruptive even when re-executed against an already-patched instance. Repeated or concurrent requests may also cause inconsistent database state. This issue has been fixed in version 0.8.0.
- Product
- FOSSBilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Cacti is an open source performance and fault management framework.CVE-2026-40941 · Other software · Cacti · reported by GitHubHigh 7.1
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypass allows which allows self-signed packages. This issue has been fixed in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Cacti is an open source performance and fault management framework.CVE-2026-40084 · Other software · Cacti · reported by GitHubMedium 6.5
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report format_file Parameter, causing arbitrary file read. This vulnerability occurs in two stages. In the first stage (stored injection), lib/html_reports.php at line 283 stores $save['format_file'] = $post['format_file'] directly into the database without any validation. In the second stage (file read), lib/reports.php at line 667 concatenates CACTI_PATH_FORMATS . '/' . $format_file, and line 670 then calls file($format_file), reading arbitrary files from the filesystem. This issue has been fixed in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Cacti is an open source performance and fault management framework.CVE-2026-40083 · Other software · Cacti · reported by GitHubHigh 7.2
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selected_items by calling cacti_unserialize(stripslashes(gnrv('selected_graphs_array'))). The cacti_unserialize() function calls unserialize() with allowed_classes set to false, which prevents object injection but still allows arbitrary string arrays to be deserialized. Then, at lines 760 to 766, the deserialized array values are passed directly into db_execute('DELETE FROM snmpagent_managers WHERE id IN (' . implode(',', $selected_items) . ')'), where they are imploded into the SQL statement without any integer validation, resulting in SQL Injection when using SNMP agent management permissions. This issue has been fixed in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Cacti is an open source performance and fault management framework.CVE-2026-40082 · Other software · Cacti · reported by GitHubMedium 5.4
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regenerate_id() after login, leading to Session Fixation. session_regenerate_id() is NOT called after successful login. The login flow at auth_login.php:203-207 directly sets $_SESSION[SESS_USER_ID] without rotating the session ID. The session cookie configuration is otherwise good (httponly=true, samesite=Strict, secure=true for HTTPS at include/global.php:513-537), but these do not prevent session fixation via same-site vectors. This issue has been fixed in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Cacti is an open source performance and fault management framework.CVE-2026-40080 · Other software · Cacti · reported by GitHubMedium 6.1
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather than a host check at str_contains($referer, CACTI_PATH_URL). When the user's login_opts == '1' (redirect to referer after login), the function used $_SERVER['HTTP_REFERER'] directly. An attacker could craft a referer such as https://evil.com/cacti/. Where CACTI_PATH_URL is /cacti/, the substring matches and the user is redirected to evil.com after login. The pre-existing validate_redirect_url() helper at lib/html_utility.php performed proper validation but was not invoked from auth_login_redirect(). This issue has been fixed in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/sCVE-2026-37149 · Other software · reported by MITREHigh 7.7
GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabiliCVE-2026-49506 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability.CVE-2026-41120 · Other software · Dell · reported by security_alert@emc.comCritical 9.8
Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() The command streamCVE-2026-53173 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() The command stream parsing loop increments the index variable a second time when a 64-bit command word is encountered (bit 14 set), but does not re-check the loop bound before writing the second word: for (i = 0; i < size / 4; i++) { bocmds[i] = cmds[0]; if (cmd & 0x4000) { i++; bocmds[i] = cmds[1]; /* unchecked */ } } The buffer bocmds is backed by a DMA allocation of exactly size bytes from drm_gem_dma_create(ddev, size), giving valid indices [0, size/4-1]. When i == size/4 - 1 on entry to an iteration and bit 14 of cmds[0] is set, bocmds[size/4-1] is written in bounds, i is then incremented to size/4, and bocmds[size/4] writes four bytes past the end of the allocation. Userspace controls both the buffer contents and the size argument via the ioctl, making this a userspace-triggerable heap out-of-bounds write. Fix by checking the incremented index against the buffer bound before the second write and returning -EINVAL if the buffer is too small to contain the extended command.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 25, 2026In the Linux kernel, the following vulnerability has been resolved: drm/gem: Try to fix change_handle ioctl, attempt 4 [airlied: just added some comments on hCVE-2026-53145 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: drm/gem: Try to fix change_handle ioctl, attempt 4 [airlied: just added some comments on how to reenable] On-list because the cat is out of the bag and we're clearly not good enough to figure this out in private. The story thus far: 5e28b7b94408 ("drm: Set old handle to NULL before prime swap in change_handle") tried to fix a race condition between the gem_close and gem_change_handle ioctls, but got a few things wrong: - There's a confusion with the local variable handle, which is actually the new handle, and so the two-stage trick was actually applied to the wrong idr slot. 7164d78559b0 ("drm/gem: fix race between change_handle and handle_delete") tried to fix that by adding yet another code block, but forgot to add the error handling. Which meant we now have two paths, both kinda wrong. - dc366607c41c ("drm: Replace old pointer to new idr") tried to apply another fix, but inconsistently, again because of the handle confusion - this would be the right fix (kinda, somewhat, it's a mess) if we'd do the two-stage approach for the new handle. Except that wasn't the intent of the original fix. W
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 24, 2026Cacti is an open source performance and fault management framework.CVE-2026-40079 · Other software · Cacti · reported by GitHubHigh 8.6
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escape_command() function. The escape_command() function at lib/rrd.php is a no-op: it returns $command unchanged. The command line built by rrdtool_function_graph() is passed through this function and then to shell_exec($full_commandline). The risk is in __rrd_execute() where text_format values from graph templates (which may contain host variable substitutions) reach shell_exec without adequate escaping. This issue has been addressed in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Cacti is an open source performance and fault management framework.CVE-2026-39951 · Other software · Cacti · reported by GitHubHigh 7.6
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a Stored SQL Injection vulnerability through graph_name_regexp in the Reports feature. This issue has been fixed in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Cacti is an open source performance and fault management framework.CVE-2026-39955 · Other software · Cacti · reported by GitHubCritical 9.8
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have pre-authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php. This issue has been fixed in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Cacti is an open source performance and fault management framework.CVE-2026-39948 · Other software · Cacti · reported by GitHubCritical 9.3
Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv() (rather than gfrv() with FILTER_VALIDATE_IS_REGEX validation) and concatenated directly into RLIKE SQL clauses in lib/html_graph.php and lib/html_tree.php, which are reachable pre-authentication through graph_view.php on installations with guest graph viewing enabled. Because the unbalanced-quote payload bypasses the regex validation that would otherwise reject it, an unauthenticated attacker can inject arbitrary SQL to compromise the confidentiality, integrity, and availability of the database. This advisory is similar to GHSA-69gg-mjfm-jjpc. This issue has been fixed in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Cacti is an open source performance and fault management framework.CVE-2026-39938 · Other software · Cacti · reported by GitHubCritical 9.8
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Cacti is an open source performance and fault management framework.CVE-2026-39900 · Other software · Cacti · reported by GitHubMedium 5.3
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflected XSS via tab parameter in the auth_profile.php JavaScript context. This issue has been fixed in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Cacti is an open source performance and fault management framework.CVE-2026-39899 · Other software · Cacti · reported by GitHubMedium 6.9
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal via filename parameter in package_import.php. This issue has been fixed in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026SiYuan is an open-source personal knowledge management system.CVE-2026-55570 · Other software · siyuan-note · reported by GitHubCritical 9
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape the untrusted fields (name, version, author, description) when they are serialized into the data-obj HTML attribute of each marketplace card. Because the attribute is single-quoted and the value is produced with JSON.stringify() (which does not escape ', <, or >), a package whose name contains a single quote breaks out of the attribute and injects arbitrary HTML. In the desktop client the main BrowserWindow runs with nodeIntegration: true, contextIsolation: false, so the injected markup escalates from DOM XSS to arbitrary OS command execution. This is the same root cause and same impact as the original advisory, reached through a sibling sink the patch did not cover. This vulnerability is fixed in 3.7.0.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026SiYuan is an open-source personal knowledge management system.CVE-2026-54759 · Other software · siyuan-note · reported by GitHubHigh 8.7
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, Lute's HTML sanitizer does not remove <iframe> elements. Combined with the SiYuan Electron client's permissive security configuration, an attacker can include a malicious <iframe> in a Bazaar package README that executes arbitrary commands on the victim's machine when the package details are viewed. No package installation is required. This vulnerability is fixed in 3.7.0.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026SiYuan is an open-source personal knowledge management system.CVE-2026-54158 · Other software · siyuan-note · reported by GitHubCritical 9.9
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell renderer genAVValueHTML interpolates cell content raw in four of its branches: text, url, phone, and mAsset. A cell value like </textarea><img src=x onerror="..."> or "><img src=x onerror="..."> breaks out of its surrounding tag and runs arbitrary JavaScript in the renderer when the victim opens the block-attribute panel. On Electron desktop the renderer runs with nodeIntegration:true, so the XSS chains to host RCE via require('child_process'). AV files live under the workspace and ride normal sync, so an attacker with write access to any synced workspace plants the payload once and it fires on every device that opens a panel containing that row.he kernel doesn't escape on the way in either, so the malicious cell persists byte-for-byte. There's no equivalent of the html.EscapeAttrVal call that protects block IAL attributes at kernel/model/blockial.go:261. This vulnerability is fixed in 3.7.0.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026SiYuan is an open-source personal knowledge management system.CVE-2026-54070 · Other software · siyuan-note · reported by GitHubHigh 7.1
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README from Markdown to HTML with the lute engine and SetSanitize(true). The lute sanitizer is an event-handler blocklist: allowAttr rejects only attribute names present in a fixed eventAttrs map copied from the w3schools legacy handler list. That map omits modern event handlers. onpointerover, onpointerdown, onauxclick, onbeforetoggle, onfocusin, onanimationstart, and ontransitionend are not in the list, so the sanitizer passes them through verbatim on any tag. The frontend assigns the rendered HTML to mdElement.innerHTML in app/src/config/bazaar.ts with no client-side DOMPurify on this path, into a normal element in the main document (no iframe, no sandbox). The kernel sends no Content-Security-Policy, X-Frame-Options, or X-Content-Type-Options header on any response, so an inline handler runs when its event fires. The README is rendered when an Administrator opens a package in Settings → Marketplace, after the one-time marketplace trust consent. Install is not required. Result: a third-party Bazaar package author runs JavaScript i
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026SiYuan is an open-source personal knowledge management system.CVE-2026-54069 · Other software · siyuan-note · reported by GitHubCritical 9.2
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chrome/Chromium extension -- including a compromised legitimate extension via supply chain attack -- can make fully authenticated admin API calls to the SiYuan kernel at 127.0.0.1:6806, enabling data exfiltration, stored XSS injection, and configuration tampering. This vulnerability is fixed in 3.7.0.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026SiYuan is an open-source personal knowledge management system.CVE-2026-54068 · Other software · siyuan-note · reported by GitHubMedium 5.9
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the /api/icon/getDynamicIcon endpoint is explicitly excluded from authentication in SiYuan's kernel router (router.go, "不需要鉴权" -- no auth needed). When called with type=8 and a valid block id parameter, this endpoint invokes RenderDynamicIconContentTemplate, which executes a Go template that includes the querySQL and queryBlocks functions. These functions run arbitrary SELECT statements against the SiYuan SQLite database. An unauthenticated network-adjacent attacker who knows a valid block ID can exfiltrate all user note content, tags, asset references, and block attributes from the database. This vulnerability is fixed in 3.7.0.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026SiYuan is an open-source personal knowledge management system.CVE-2026-54067 · Other software · siyuan-note · reported by GitHubCritical 9.9
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, CSS snippet body containing </style> breaks out of its surrounding <style> tag when renderSnippet() interpolates it via insertAdjacentHTML. A payload like runs arbitrary JavaScript in the renderer. On Electron desktop builds the renderer runs with nodeIntegration:true, so require('child_process') is reachable from the injected handler and the XSS chains to host RCE. Snippets sync via the workspace repository, so an attacker with write access to any synced workspace plants the payload once and it fires on every device that pulls. The bug also bypasses the user's enabledCSS / enabledJS separation. A user who turned enabledJS off was making a deliberate call not to run untrusted JavaScript; the CSS path runs it anyway. This vulnerability is fixed in 3.7.0.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026SiYuan is an open-source personal knowledge management system.CVE-2026-54066 · Other software · siyuan-note · reported by GitHubHigh 7.5
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the /export/ route but the identical root cause remains in the /assets/*path route. In publish mode (anonymous read-only HTTP endpoint, default port 6808), an unauthenticated remote attacker can read arbitrary files inside WorkspaceDir — including conf/conf.json (which contains the AccessAuthCode SHA256 hash, API token, and sync keys), temp/siyuan.db, temp/blocktree.db, and siyuan.log — by double-URL-encoding .. segments. This vulnerability is fixed in 3.7.0.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026SiYuan is an open-source personal knowledge management system.CVE-2026-50551 · Other software · siyuan-note · reported by GitHubCritical 9.9
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Cacti is an open source performance and fault management framework.CVE-2026-39897 · Other software · Cacti · reported by GitHubMedium 5.3
Cacti is an open source performance and fault management framework. Versions 1.2.30 and below contain a Reflected XSS vulnerability in the html_auth_footer. This issue has been fixed in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Cacti is an open source performance and fault management framework.CVE-2026-39894 · Other software · Cacti · reported by GitHubLow 2.9
Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtool_function_update() can corrupt RRDtool metric values. The rrdtool_function_update() function checks metric values with is_numeric() and concatenates them into the RRDtool update command via PHP string interpolation. PHP's string cast of floats is locale-sensitive: if LC_NUMERIC uses comma as decimal separator (e.g., de_DE), a value of 1.5 becomes "1,5". RRDtool expects . as decimal separator, causing metric data to shift into wrong columns or be silently dropped. No setlocale() reset is present in the update path. This causes a data integrity issue, but is not remotely exploitable; it requires server locale misconfiguration. The issue has been fixed in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Cacti is an open source performance and fault management framework.CVE-2026-39893 · Other software · Cacti · reported by GitHubCritical 9.8
Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatenated into a RLIKE SQL clause without sanitization. The endpoint does not require authentication (graph viewing supports guest access via the configured guest user), so the SQLi was reachable pre-auth on installs with guest viewing enabled. This issue was fixed in version 1.2.31.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026FOSSBilling is a free, open-source billing and client management system.CVE-2026-33543 · Other software · FOSSBilling · reported by GitHubCritical 9.3
FOSSBilling is a free, open-source billing and client management system. Versions 0.7.2 and prior expose a guest API endpoint, /api/guest/staff/create, intended for initial administrator bootstrap. Due to a flawed admin-existence check, the endpoint remains usable after an administrator already exists. The flawed guard check uses is_countable() on a value that returns a Model_Admin object or null rather than a countable type, causing the expression to always evaluate as true and bypass the intended protection. As a result, an attacker can reach the unprotected endpoint to create a new administrator account and immediately authenticate, gaining a fully privileged admin session even when an admin already exists. This issue has been fixed in version 0.8.0.
- Product
- FOSSBilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Twenty is an open-source CRM (customer relationship management) platform.CVE-2026-55583 · Other software · twentyhq · reported by GitHubHigh 7.6
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was vulnerable to a cross-workspace insecure direct object reference (IDOR) in the AI agent monitor's AgentTurnResolver, in packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-monitor/reso lvers/agent-turn.resolver.ts. The agentTurns(agentId) query and the evaluateAgentTurn(turnId) mutation looked up rows by agentId or id only; although AgentTurnEntity has a workspaceId column, it was not included in the WHERE clause, and the class-level guards only checked that the caller was authenticated in some workspace rather than that the requested object belonged to it, with the same flaw present in agent-turn-grader.service.ts. As a result, any authenticated user with the AI settings flag, a workspace owner by default, could target any other workspace on the same instance given the victim's agentId or turnId: agentTurns returned the victim's full chat history including message parts such as raw chat text, tool calls, and tool outputs, while evaluateAgentTurn inserted an agentTurnEvaluation row with the victim's workspaceId and fed the victim's turn into the default LLM. The agentId
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026FOSSBilling is a free, open-source billing and client management system.CVE-2026-27708 · Other software · FOSSBilling · reported by GitHubHigh 7.1
FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, the Servicecustom Client API's __call method accepts an order_id parameter and fetches the associated order without verifying the authenticated client owns it, potentially exposing cross-client data through IDOR. An authenticated client can access any other client's custom service by guessing sequential order IDs. This can lead to a confidentiality breach — attackers can read client PII (name, email, phone, address, company details, VAT number) and service configuration data belonging to other clients. This issue has been fixed in version 0.8.0.
- Product
- FOSSBilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Ghost is a Node.js content management system.CVE-2026-53949 · Other software · TryGhost · reported by GitHubMedium 5.3
Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes' case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. This vulnerability is fixed in 6.21.2.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Ghost is a Node.js content management system.CVE-2026-53948 · Other software · TryGhost · reported by GitHubMedium 5.4
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the site, this could have been used to facilitate stored cross-site scripting against site visitors or staff. This vulnerability is fixed in 6.21.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Ghost is a Node.js content management system.CVE-2026-53947 · Other software · TryGhost · reported by GitHubMedium 5.3
Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. This vulnerability is fixed in 6.21.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Ghost is a Node.js content management system.CVE-2026-53946 · Other software · TryGhost · reported by GitHubMedium 5.4
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card at an attacker-chosen host and cause the Ghost server to request it on their behalf, including hosts on internal networks or cloud instance metadata endpoints that would not normally be reachable from the public internet. This vulnerability is fixed in 6.21.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Ghost is a Node.js content management system.CVE-2026-53945 · Other software · TryGhost · reported by GitHubMedium 4
Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacker to coerce the Ghost server into reaching hosts on internal networks through features that issue external fetches. This vulnerability is fixed in 6.21.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Ghost is a Node.js content management system.CVE-2026-53944 · Other software · TryGhost · reported by GitHubMedium 5.8
Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external request, it is possible to bypass the IP filter that ensures the request isn't going to an internal service using an IPv6 literal which maps to a private IPv4 address. This vulnerability is fixed in 6.21.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.