Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
399,200 results · page 618 of 7984
Sep 17, 2026Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.CVE-2026-73999 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.
- Affected
- up to 1.16.0
- What to do
- Affects up to 1.16.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026In BMCtest, Ironic is started without authentication and TLS for the duration of the test.CVE-2026-71568 · Other software · openshift-metal3 · reported by 74b3a70d-cca6-4d34-9789-e83b222ae3beMedium 5.3
In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity.
- Product
- bmctest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.CVE-2026-66676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.CVE-2026-66631 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.
- Affected
- up to 1.9.21
- What to do
- Affects up to 1.9.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.CVE-2026-66630 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions.CVE-2026-66628 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions.
- Affected
- up to 3.8.11
- What to do
- Affects up to 3.8.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.CVE-2026-66626 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.
- Affected
- up to 4.0
- What to do
- Affects up to 4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.CVE-2026-66625 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.
- Affected
- up to 2.7.2.1
- What to do
- Affects up to 2.7.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.CVE-2026-66624 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.
- Affected
- up to 2.22.0
- What to do
- Affects up to 2.22.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Administrator SQL Injection in Newsletters <= 4.18 versions.CVE-2026-66619 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Newsletters <= 4.18 versions.
- Affected
- up to 4.18
- What to do
- Affects up to 4.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Administrator SQL Injection in WP Maps <= 4.9.9 versions.CVE-2026-66618 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Maps <= 4.9.9 versions.
- Affected
- up to 4.9.9
- What to do
- Affects up to 4.9.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.CVE-2026-66617 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.CVE-2026-66608 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.
- Affected
- up to 2.0.19
- What to do
- Affects up to 2.0.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.CVE-2026-66580 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.
- Affected
- up to 7.12.0
- What to do
- Affects up to 7.12.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.CVE-2026-66579 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.
- Affected
- up to 2.9.2.1
- What to do
- Affects up to 2.9.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.CVE-2026-66578 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.CVE-2026-66577 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.
- Affected
- up to 3.6.3
- What to do
- Affects up to 3.6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.CVE-2026-66576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.CVE-2026-66575 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.
- Affected
- up to 51.1.81
- What to do
- Affects up to 51.1.81. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.CVE-2026-66574 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.
- Affected
- up to 8.8.3
- What to do
- Affects up to 8.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.CVE-2026-66573 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.
- Affected
- up to 2.3.3.1
- What to do
- Affects up to 2.3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.CVE-2026-66572 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.
- Affected
- up to 2.4.10
- What to do
- Affects up to 2.4.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.CVE-2026-66571 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.
- Affected
- up to 1.4.0.5
- What to do
- Affects up to 1.4.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.CVE-2026-62108 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions.CVE-2026-62104 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions.
- Affected
- up to 2.6.8
- What to do
- Affects up to 2.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.CVE-2026-62101 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.
- Affected
- up to 5.4.2
- What to do
- Affects up to 5.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter.CVE-2026-14850 · Other software · MobiAPParc · reported by cve-coordination@incibe.esHigh 8.8
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership.
- Product
- MobiAPParc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-baseCVE-2026-92932 · Other software · misp · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 5.1
In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0. Because PHP's && operator has higher precedence than ||, the expression is evaluated as ($options['readFile'] && strpos($input, 'http://') === 0) || strpos($input, 'https://') === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure
- Product
- sachertortephp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function.CVE-2026-92921 · Other software · cjbi · reported by VulnCheckMedium 6.9
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort.
- Product
- admin3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permisCVE-2026-92920 · Other software · cjbi · reported by VulnCheckMedium 5.3
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request.
- Product
- admin3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on CVE-2026-92919 · Other software · cjbi · reported by VulnCheckHigh 7.2
admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process.
- Product
- admin3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events.CVE-2026-92918 · Other software · cjbi · reported by VulnCheckHigh 8.7
admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.
- Product
- admin3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026A flaw was found in the foreman_remote_execution plugin's template invocations controller.CVE-2026-92904 · Other software · Red Hat · reported by Red HatMedium 4.3
A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job invocation visibility is restricted by a permission filter can enumerate job invocation IDs and read the live output, rendered script, and input values for other users' job invocations within their own organizations.
- Product
- Red Hat Satellite 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 17, 2026Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulCVE-2026-81481 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
- Product
- OpenManage Server Administrator Managed Node (Patch) for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026A flaw was found in Redis community.CVE-2026-92925 · Other software · Red Hat · reported by Red HatHigh 7.1
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 17, 2026Grav is a flat-file CMS.CVE-2026-92917 · Other software · getgrav · reported by VulnCheckHigh 8.7
Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string): GravExtension::assertSandboxDumpSafe() determines sandbox state by calling SandboxExtension::isSandboxed() without a Source argument, which reports only the global sandbox flag that Grav never enables, so the guard added in GHSA-mc5q-6hpj-rp7j never executes. As a result, an authenticated user with page-edit rights can render {{ config|print_r }} in page content with Twig processing enabled and dump Grav's entire merged configuration — print_r reflects the real Config object held in a private property of the SandboxConfig facade, bypassing its path redaction — exposing plugin secrets such as SMTP credentials, API tokens, webhook secrets and cache backend passwords. Grav 1.7 is not affected because it ships no Twig content sandbox. The issue is fixed in 2.0.22, where the affected filters are registered with Twig's needs_is_sandboxed flag.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 17, 2026Grav is a flat-file CMS.CVE-2026-92916 · Other software · getgrav · reported by VulnCheckHigh 8.7
Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the default), the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest() intercepts any path containing /__clockwork/ during bootstrap and passes it to Debugger::debuggerRequest(), which performs no user lookup, IP restriction, or Clockwork authenticator check, and also supports anonymous pagination over the entire stored history. With the shipped censored: false default, each stored record contains raw request cookies (including Grav's session cookie, whose value is the PHP session id, allowing an attacker to resume another user's session, including an authenticated admin's), the full parsed request body (Grav's login form posts data[username]/data[password], so passwords are stored in plaintext because Clockwork's password filter only inspects top-level keys), and the site's entire system and plugin configuration, including operator-saved secrets such as SMTP credentials, third-party API keys, and licence keys. Authorization and X-API-Token headers are stored even when censo
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 17, 2026WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php.CVE-2026-92915 · Other software · WWBN · reported by VulnCheckMedium 6.9
WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement ($global['ignoreUserMustBeLoggedIn'] = 1), takes users_id directly from the query string, and calls User::sendVerificationLink() with no session requirement, no CSRF/global token, no relationship check between caller and target, and no enforceRateLimit() call. The only intended throttle is keyed to the caller's own session, so cookie-less requests are never limited. An unauthenticated remote attacker can therefore cause an arbitrary number of verification emails to be sent to any account ID, and can enumerate accounts and their verification status from the three distinct JSON responses ("Verification Sent", "Already verified", "Unknown error"). In addition, createVerificationCode() invokes $user->setRecoverPass() and saves the user, so each anonymous request writes a live password-recovery token onto the targeted account; that token is embedded in base64 in the verification link emailed to the account owner and is accepted by objects/userRecoverPassSave.json.php as the credential for setting a new passwor
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 17, 2026AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equalityCVE-2026-92914 · Other software · WWBN · reported by VulnCheckHigh 8.6
AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less GET request to verifyChallenge.json.php, which evaluates null == null and marks authentication complete.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 17, 2026AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / lCVE-2026-92913 · Other software · WWBN · reported by VulnCheckCritical 9.1
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode() in objects/functions.php derives the code entirely from uniqid() (sprintf('%08x%05x', seconds, microseconds)) with a single non-CSPRNG rand() character used only as padding, reducing the code space to roughly 36 x 10^6 (~2^25) values for a known generation second. Because plugin/API/set.json.php?APIName=login_code can be called without authentication, it also serves as an oracle for the server's exact microtime. An unauthenticated remote attacker who guesses a valid, unexpired code (codes expire after 10 minutes) can redeem it at plugin/API/get.json.php?APIName=login_code to obtain the target account's email address and a User::getUserHash(users_id, '+1 year') value, a credential accepted in place of the account password for one year, resulting in account takeover. No patched version is available.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 17, 2026AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entroCVE-2026-92912 · Other software · WWBN · reported by VulnCheckHigh 8.3
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the five-digit microsecond component to forge valid stream keys and broadcast content as the channel owner.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 17, 2026A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4.CVE-2026-92860 · Other software · rcourtman · reported by VulDBCritical 9.4
A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation. The attack may be performed from remote. Upgrading the affected component is advised.
- Product
- Pulse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_paCVE-2026-90823 · Other software · FatPipe Networks · reported by contact@securifera.comCritical 9.8
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that reaches an unchecked copy into a fixed-size stack buffer, potentially allowing arbitrary code execution as root. The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources. Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).
- Product
- MPVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfatpipeinc.comsecurifera.com
Sep 17, 2026FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daCVE-2026-90822 · Other software · FatPipe Networks · reported by contact@securifera.comCritical 9.8
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. An unauthenticated remote attacker with access to the affected management interface can submit crafted input to the AuthFormServlet endpoint, causing authentication data to be processed by a shell and allowing arbitrary commands to execute as root. The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources. Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).
- Product
- MPVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfatpipeinc.comsecurifera.com
Sep 17, 2026Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability.CVE-2026-81480 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
- Product
- OpenManage Server Administrator Managed Node (Patch) for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability.CVE-2026-81479 · Other software · Dell · reported by security_alert@emc.comMedium 5.8
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
- Product
- OpenManage Server Administrator Managed Node (Patch) for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability.CVE-2026-81478 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
- Product
- OpenManage Server Administrator Managed Node (Patch) for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability.CVE-2026-81477 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
- Product
- OpenManage Server Administrator Managed Node (Patch) for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjCVE-2026-81476 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
- Product
- OpenManage Server Administrator Managed Node (Patch) for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability.CVE-2026-81475 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
- Product
- OpenManage Server Administrator Managed Node (Patch) for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.