Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,036 results · page 6 of 41
Jul 16, 2026An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device.CVE-2026-60073 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govMedium 5.2
An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system crash or disclosure of kernel memory.
- Product
- Productivity Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comautomationdirect.com
Jul 16, 2026An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request.CVE-2026-57896 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govMedium 6.9
An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could lead to limited information disclosure or disruption of the affected product.
- Product
- Productivity Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comautomationdirect.com
Jul 16, 2026An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentCVE-2026-61389 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govHigh 7.3
An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.
- Product
- Productivity Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comautomationdirect.com
Jul 16, 2026An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request.CVE-2026-60140 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govMedium 6.9
An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This can lead to exposing sensitive information or causing the affected product to become unstable or unavailable.
- Product
- Productivity Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comautomationdirect.com
Jul 16, 2026An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentCVE-2026-60063 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govHigh 7.3
An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.
- Product
- Productivity Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comautomationdirect.com
Jul 16, 2026Activepieces is an open source AI workflow automation platform.CVE-2026-53536 · Other software · activepieces · reported by GitHubMedium 5.3
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT against the shared signing secret but did not check the token's audience, and combined with a missing null-check on the decoded fileId, this allowed any caller holding any valid Activepieces JWT (including a freshly created user's own access token) to receive a step-file belonging to another tenant. The file returned was whatever PostgreSQL happened to scan first for type = FLOW_STEP_FILE, varying over time as the database changed, so an authenticated user could obtain step-file attachments belonging to other tenants on the same instance; the attacker could not target a specific victim or file, and the access was read-only with no integrity or availability impact. This issue is fixed in version 0.83.0.
- Product
- activepieces
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Activepieces is an open source AI workflow automation platform.CVE-2026-53535 · Other software · activepieces · reported by GitHubMedium 5.9
Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed those writes to escape the intended workspace and land on arbitrary paths on the host filesystem: Git's symbolic-link handling was not disabled on the clone, so an attacker who controlled the remote repository could include symlinks that redirected the writes, and several user-supplied identifiers used to build on-disk paths (the repository slug and the externalId of tables, flows, and connections) were not validated against directory-traversal sequences such as ../. On a self-hosted Enterprise Edition deployment, a user authorized to configure or push to a git-sync repository (holding the WRITE_PROJECT_RELEASE permission) could cause the server to overwrite files anywhere the Activepieces process user can write, which depending on host layout can be leveraged for tampering, denial of service, or remote code execution. This issue is fixed in version 0.82.0.
- Product
- activepieces
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store.CVE-2026-46341 · Other software · apify · reported by GitHubMedium 6.1
The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.9.21, the fetch-apify-docs tool in src/tools/common/fetch_apify_docs.ts validates allowlisted documentation domains with String.startsWith() rather than URL hostname comparison, allowing attacker-controlled URLs such as `https://docs.apify.com.evil.com/` and `https://docs.apify.com@evil.com/` to pass the ALLOWED_DOC_DOMAINS check and return arbitrary fetched content to the LLM. This issue is fixed in version 0.9.21.
- Product
- apify-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Microsoft UFO open-source framework for intelligent automation across devices and platforms.CVE-2026-55440 · Computers, phones & browsers · microsoft · reported by GitHubMedium 6.5
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in ufo/server/ws/handler.py called get_or_create_session in ufo/server/services/session_manager.py without owner_client_id, allowing an authenticated client to create an unowned attacker-chosen session_id such as constellation_task_id = f"{task_name}@{task_id}" and deny the legitimate owner or exhaust memory with phantom sessions. This issue is fixed in version 3.0.7.
- Product
- UFO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Microsoft UFO open-source framework for intelligent automation across devices and platforms.CVE-2026-54568 · Computers, phones & browsers · microsoft · reported by GitHubMedium 4.3
Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICE_INFO_REQUEST with another device's target_id and receive that device's server-side system_info through ufo/server/ws/handler.py, because handle_device_info_request and get_device_info did not enforce the constellation-only role or object-level authorization boundary. This issue is fixed in version 3.0.6.
- Product
- UFO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder: Arbitrary file deletionCVE-2026-15008 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function in all versions up to, and including, 7.3.1.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires a Forminator form connected to an Uncanny Automator recipe configured for 'Everyone', allowing unauthenticated form submissions to supply the malicious serialized payload; a gadget chain is present within the plugin via the Action_Helpers_Email __destruct() method, meaning no external gadget library is required.
- Product
- Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder
- Affected
- up to 7.3.1.4
- What to do
- Affects up to 7.3.1.4. Update Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 15, 2026A flaw was found in the AAP Gateway Envoy proxy configuration.CVE-2026-12382 · Other software · Red Hat · reported by Red HatHigh 8.2
A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.
- Product
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 15, 2026Lightpanda is a headless browser designed for AI and automation.CVE-2026-52843 · Other software · lightpanda-io · reported by GitHubCritical 9.3
Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9.
- Product
- browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Lightpanda is a headless browser designed for AI and automation.CVE-2026-52842 · Other software · lightpanda-io · reported by GitHubCritical 9.3
Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as `http://attacker.com/@victim.com/` was fetched from attacker.com but treated as `http://victim.com`, allowing a complete Same-Origin Policy bypass. This issue is fixed in version 0.3.1.
- Product
- browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling.CVE-2026-9636 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.2
A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a connection using a certificate that should be untrusted, potentially bypassing CIP Security protections.
- Product
- ControlLogix® 5580, CompactLogix® 5380, GuardLogix® 5580, Compact GuardLogix® 5380, 1756-EN4TR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosaix™ Private Cloud.CVE-2026-9292 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.4
A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosaix™ Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts that are permanently stored on the server. This vulnerability can result in the execution of malicious JavaScript when other users access the affected page, potentially allowing for account takeover, credential theft, or redirection to a malicious website.
- Product
- FactoryTalk® DataMosaix™ Private Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration.CVE-2026-9128 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 7.3
A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution with the same permissions of the user running the application.
- Product
- Studio 5000 Logix Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file.CVE-2026-9127 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 7.3
A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.
- Product
- Studio 5000 Logix Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files.CVE-2026-9108 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comMedium 5.4
A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution.
- Product
- Studio 5000 Logix Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A denial-of-service security issue exists in the affected products.CVE-2026-12659 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing crafted CIP packets sent to the adapter. A power cycle is required to recover the module and associated I/O.
- Product
- The FLEX 5000® EtherNet/IP Adapter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API.CVE-2026-11917 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 7.2
A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the application's intended directory.
- Product
- FactoryTalk ThinManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072.CVE-2025-11698 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.2
A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).
- Product
- CompactLogix® 5380 Recovery Image Compact GuardLogix® 5380 Recovery Image CompactLogix® 5480 Recovery Image ControlLogix® 5580 Recovery Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packCVE-2026-9653 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt device connections, though device connections will recover immediately after.
- Product
- 1756-EN2, 1756-EN3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A denial-of-service security issue exists in the 1719-AENTR.CVE-2026-9140 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A denial-of-service security issue exists in the 1719-AENTR. The security issue stems from improper handling of a UDP unicast network storm, which causes the device to become overloaded and lose communication. A power cycle is required to recover.
- Product
- 1718-AENTR/1719-AENTR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication.CVE-2026-10714 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.8
A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication. The vulnerability stems from the application not verifying that the JWT algorithm is configured for RSA, enabling an attacker to set the algorithm to "none" and craft forged tokens. This could allow an authenticated low-privilege user to impersonate any authorized user on the FTSP server, resulting in unauthorized access to system configuration and the ability to grant permissions to other systems protected by FTSP.
- Product
- FactoryTalk® Services Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A denial-of-service security issue exists in 1734 POINT I/O™ module.CVE-2026-10573 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comMedium 6.3
A denial-of-service security issue exists in 1734 POINT I/O™ module. The security issue stems from improper handling of crafted CIP messages, which can cause the module to enter a faulted state. A restart is required to recover.
- Product
- 1734 POINT I/O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A denial-of-service issue exists in 5380/5480/5580 controllers.CVE-2025-12012 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.2
A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).
- Product
- CompactLogix® 5370 Compact GuardLogix® 5370 ControlLogix® 5570 GuardLogix® 5570
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A denial-of-service issue exists in 5370/5570 controllers.CVE-2025-12011 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.2
A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).
- Product
- CompactLogix® 5370 Compact GuardLogix® 5370 ControlLogix® 5570 GuardLogix® 5570
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component.CVE-2026-8314 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 7
A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
- Product
- Arena® Simulation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component.CVE-2026-8313 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 7
A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
- Product
- Arena® Simulation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 14, 2026A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component.CVE-2026-8085 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 7
A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
- Product
- Arena® Simulation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jul 11, 2026AI Chatbot & Workflow Automation by AIWU: Authorization bypassCVE-2026-6804 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to publish draft WordPress posts, exposing unpublished content, or unpublish live content, causing service disruption, by supplying arbitrary scenario IDs.
- Product
- AI Chatbot & Workflow Automation by AIWU
- Affected
- up to 1.4.12
- What to do
- Affects up to 1.4.12. Update AI Chatbot & Workflow Automation by AIWU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026AI Chatbot & Workflow Automation by AIWU: Missing AuthorizationCVE-2026-6803 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.12. This is due to missing capability checks and nonce verification on AJAX actions registered under both wp_ajax_ and wp_ajax_nopriv_ hooks, as the base controller's getPermissions() returns an empty array and neither removeGroup nor clear are added to getNoncedMethods(), causing the authorization gate to unconditionally return true for these actions. This makes it possible for unauthenticated attackers to delete specific records by ID or delete all records from any module's database table by unauthenticated attackers.
- Product
- AI Chatbot & Workflow Automation by AIWU
- Affected
- up to 1.4.12
- What to do
- Affects up to 1.4.12. Update AI Chatbot & Workflow Automation by AIWU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 10, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Adam Retail Automation Ltd.CVE-2026-2397 · Other software · Adam Retail Automation Ltd. · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injection. This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MobilMen 20T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd.CVE-2026-2398 · Other software · Adam Retail Automation Ltd. · reported by iletisim@usom.gov.trHigh 8.8
Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows Privilege Escalation. This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MobilMen 20T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails: Generic SQL InjectionCVE-2026-12918 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to generic SQL Injection via the 'recipients' parameter in all versions up to, and including, 1.24.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the malicious payload is first stored unsanitized via a POST request to /mrm/v1/campaigns/ (bypassing filter_recipients() validation because an int-cast of a string like '1) OR ...' evaluates to a real numeric ID), and is then triggered by a subsequent GET request to /mrm/v1/campaigns/{id} that deserializes the recipients and passes the raw id string through array_column() into the vulnerable query.
- Product
- Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
- Affected
- up to 1.24.1
- What to do
- Affects up to 1.24.1. Update Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2026n8n is an open source workflow automation platform.CVE-2026-59209 · Other software · n8n-io · reported by GitHubHigh 7.1
n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026n8n is an open source workflow automation platform.CVE-2026-59208 · Other software · n8n-io · reported by GitHubHigh 7.6
n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than one trusted token-exchange issuer resolved external identities to local accounts using only the JWT sub claim and ignored the iss claim, allowing an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim. This issue is fixed in versions 2.27.4 and 2.28.1.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026n8n is an open source workflow automation platform.CVE-2026-59207 · Other software · n8n-io · reported by GitHubHigh 7.1
n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL, allowing a member-level user with use-only access to a shared credential to send its secret to an external server they control. This issue is fixed in versions 2.27.4 and 2.28.1.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026n8n is an open source workflow automation platform.CVE-2026-59206 · Other software · n8n-io · reported by GitHubHigh 7.1
n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated requests to be treated as a privileged user and exposing user and project listing endpoints. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails: Time-based SQL InjectionCVE-2026-14342 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter in all versions up to, and including, 1.24.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
- Affected
- up to 1.24.2
- What to do
- Affects up to 1.24.2. Update Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2026AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for: Stored Cross-Site ScriptingCVE-2026-12170 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alignment' attribute in all versions up to, and including, 10.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for
- Affected
- up to 10.10.2
- What to do
- Affects up to 10.10.2. Update AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 8, 2026Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol.CVE-2026-58192 · Other software · appium · reported by GitHubHigh 8.6
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../ sequences and recursively delete arbitrary writable files or directories. This issue is fixed in version 1.1.6.
- Product
- appium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol.CVE-2026-58191 · Other software · appium · reported by GitHubMedium 6.5
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.
- Product
- appium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL.CVE-2026-6901 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comHigh 8.4
Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5.
- Product
- APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-cws-assets.de-fra-1.linodeobjects.com
Jul 6, 2026Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL.CVE-2026-6900 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comCritical 9.1
Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5.
- Product
- APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-cws-assets.de-fra-1.linodeobjects.com
Jul 2, 2026Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injectinCVE-2024-58352 · Other software · Shenzhen Landray Software Co., Ltd. · reported by VulnCheckHigh 8.7
Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input sanitization in the string-concatenated filter expression passed to the Hibernate findList() call to extract sensitive data such as administrator password hashes and, with sufficient database privileges, perform file-write operations enabling remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-11 (UTC).
- Product
- Landry Office Automation (OA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netblog.csdn.net
Jul 2, 2026An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541.CVE-2026-11946 · Other software · open62541 project / o6 Automation GmbH · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 7.5
An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32 length field) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configurations. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.
- Product
- open62541
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Generic SQL InjectionCVE-2026-14029 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'select' parameter in all versions up to, and including, 4.5.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the attacker to hold a Groundhogg custom role with the view_contacts capability, which is granted by default to several built-in Groundhogg roles above the base subscriber level.
- Product
- Groundhogg — CRM, Newsletters, and Marketing Automation
- Affected
- up to 4.5.8
- What to do
- Affects up to 4.5.8. Update Groundhogg — CRM, Newsletters, and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 2, 2026An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541.CVE-2026-33592 · Other software · open62541 project / o6 Automation GmbH · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 7.5
An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is not validated for length or array size. An attacker can declare an arbitrarily large string (up to ~3.9 GB) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configuration. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.
- Product
- open62541
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.