Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
330,644 results · page 6 of 6613
Nov 6, 2026In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settingsCVE-2026-123330 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actionsCVE-2026-123329 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptionsCVE-2026-123327 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspensionCVE-2026-123326 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.1
In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox pageCVE-2026-123325 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.1
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possibleCVE-2026-123324 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.7
In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests withoCVE-2026-123323 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.4
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loaderCVE-2026-123322 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.3
In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader
- Product
- WebStorm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious serverCVE-2026-123320 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.1
In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server
- Product
- Toolbox App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engineCVE-2026-123318 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.8
In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine
- Product
- Ktor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands optionCVE-2026-123315 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7
In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option
- Product
- Junie CLI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client requestCVE-2026-123314 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.1
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settingsCVE-2026-123313 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.3
In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possibleCVE-2026-123311 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown previewCVE-2026-123309 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.1
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projectsCVE-2026-123308 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.3
In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possibleCVE-2026-123307 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.8
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runsCVE-2026-123306 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.4
In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote hostCVE-2026-123305 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck pathCVE-2026-123304 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possibleCVE-2026-123301 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.2
In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappingsCVE-2026-123300 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.7
In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possibleCVE-2026-123299 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.1
In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possibleCVE-2026-123298 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5
In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flowCVE-2026-123297 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.8
In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possibleCVE-2026-123296 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpointCVE-2026-123295 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flowCVE-2026-123294 · Other software · JetBrains · reported by cve@jetbrains.comCritical 9.6
In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path settingCVE-2026-123293 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebookCVE-2026-123291 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpointCVE-2026-123290 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify filesCVE-2026-123289 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor linkCVE-2026-123288 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reportsCVE-2026-123287 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.9
In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session tokenCVE-2026-123286 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.9
In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injectionCVE-2026-123285 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.3
In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared contentCVE-2026-123284 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated sessionCVE-2026-123282 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.4
In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount brokerCVE-2026-123281 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reportsCVE-2026-123280 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpointCVE-2026-123278 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.7
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on LinuxCVE-2026-123277 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5
In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux
- Product
- CLion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026undici is an HTTP client for Node.js.CVE-2026-116630 · Other software · undici · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 5.9
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When the origin that stored the response redirects the conditional revalidation request to another origin, the redirect handler strips origin-bound credential headers but not the cache-generated If-None-Match or If-Modified-Since validators, so the redirect destination receives the original origin's validator and undici treats its 304 as successful revalidation of the stored representation. As a result, a shared cache can serve the original origin's stored authenticated response, including one gated by Authorization, to a later unauthenticated caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Nov 6, 2026Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process mCVE-2026-115701 · Other software · ninenines · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.2
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. Once a request has been received in full and its handler is still running, cowboy_http:parse/2 in src/cowboy_http.erl appends every further byte that arrives on the keep-alive connection to the connection buffer and returns to the receive loop without parsing it. The socket stays in active mode and no limit applies to this buffer: max_request_line_length, max_headers and the other parser limits only take effect once the handler returns and parsing resumes, and the only timer in this state is idle_timeout (default 60 seconds), which is reset on every received chunk. A client can therefore send an arbitrary amount of data on one connection for as long as the handler runs, and a few connections to an endpoint that holds requests open can drive the Erlang VM into out-of-memory conditions. This issue affects cowboy: from 2.18.0 onward.
- Product
- cowboy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Nov 6, 2026Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 CVE-2026-113431 · Other software · ninenines · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.7
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cow_http2_machine:headers_decode/4 in src/cow_http2_machine.erl decodes every HEADERS block with cow_hpack:decode/3. It bounds the compressed block size and the number of fields, but not the size of the decoded header list that RFC 9113 section 6.5.2 places under SETTINGS_MAX_HEADER_LIST_SIZE. A peer stores one header value of up to the dynamic table size (4096 bytes by default) and then references it with one-byte indexed fields, so about 100 bytes on the wire decode to a header list of about 390 KB. A consumer that copies the decoded values, as Cowboy does when cowboy_http2:headers_to_map/2 joins repeated cookie fields into one binary, allocates that amount for every stream. The total across streams and connections is not bounded. This issue affects cowlib: from 2.7.0 onward.
- Product
- cowlib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Nov 6, 2026Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels: PHP Code InjectionCVE-2026-87964 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the `feedConfigCustom2` parameter — only `wp_unslash()` is applied before the value is stored verbatim via `update_option()`, and during feed generation the `Custom2Template::evaluate_return()` method passes the stored `{(return ...)}` template expressions directly to PHP's `eval()` function without any code-level sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server, escalating their privileges beyond what the role normally permits to full remote code execution and site takeover. The `ctxfeed_custom2_eval_enabled` option defaults to `true`, meaning no additional administrator configuration is required for this attack path to be exploitable out of the box.
- Product
- Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
- Affected
- up to 8.0.26
- What to do
- Affects up to 8.0.26. Update Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2026A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authoriCVE-2026-33379 · Other software · Grafana · reported by security@grafana.comHigh 8.5
A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Redirection for Contact Form 7: Authorization bypassCVE-2026-120659 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site.
- Product
- Redirection for Contact Form 7
- Affected
- up to 3.2.14
- What to do
- Affects up to 3.2.14. Update Redirection for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2026undici is an HTTP client for Node.js.CVE-2026-120474 · Other software · undici · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 6.5
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Nov 6, 2026undici is an HTTP client for Node.js.CVE-2026-120423 · Other software · undici · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 5.9
undici is an HTTP client for Node.js. In versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3, fetch verifies Subresource Integrity metadata by splitting the integrity string on a single space, but the SRI grammar separates metadata by ASCII whitespace, which also includes the horizontal tab. An integrity value whose digest is preceded by a tab or other ASCII whitespace is parsed as a single unrecognized token and skipped, and when no recognized algorithm remains undici treats the integrity list as empty and accepts the response, so a server returning a body different from the pinned digest passes the check. An application that pins a response with a valid but whitespace-surrounded SRI value receives attacker-controlled bytes with no integrity error, and the attacker needs only to control the response body, not the integrity metadata. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, supply SRI integrity metadata without surrounding whitespace, using a single space to separate multiple digests.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.