Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29,210 results · page 63 of 585
Aug 20, 2026Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.CVE-2026-70105 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.CVE-2026-69855 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.7
Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.
- Product
- Microsoft Copilot in Azure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.CVE-2026-69851 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Entra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.CVE-2026-69836 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Entra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network.CVE-2026-69558 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.6
Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft Partner Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.CVE-2026-69555 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure ARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network.CVE-2026-69543 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.5
Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network.
- Product
- Azure Virtual Machines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.CVE-2026-69519 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.6
Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.
- Product
- Azure Stack HCI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.CVE-2026-69419 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.5
Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.
- Product
- Azure Data Manager for Energy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.CVE-2026-66800 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.6
Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.
- Product
- Azure Data Factory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.CVE-2026-66309 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.1
Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
- Product
- Azure SQL Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.CVE-2026-65816 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Web Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.CVE-2026-65801 · Email & office · Microsoft · reported by secure@microsoft.comCritical 10
Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Exchange Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.CVE-2026-63509 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.CVE-2026-62834 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Data Factory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments.CVE-2026-55769 · Other software · cloudnative-pg · reported by GitHubCritical 9.4
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning search_path in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER could create overloaded built-in operators in the public schema and change the database or role search_path, causing instance-manager introspection queries such as SELECT COUNT(*) > 0 FROM pg_catalog.pg_extension WHERE extname = $1 to execute attacker-controlled functions as the postgres superuser. The same trust issue affected direct sql.Open("pgx", ...) callsites and the public.user_search SECURITY DEFINER function, enabling PostgreSQL superuser access, operating system command execution through COPY ... FROM PROGRAM, and access to the pod ServiceAccount token. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.
- Product
- cloudnative-pg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments.CVE-2026-55765 · Other software · cloudnative-pg · reported by GitHubHigh 8.5
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pg_stat_statements was preloaded with track_utility enabled and an untrusted tenant held pg_monitor or pg_read_all_stats, the tenant could recover platform-managed superuser or application-owner passwords, reconnect through enabled superuser TCP access, and execute operating system commands in the database pod with `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.
- Product
- cloudnative-pg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Buffer overflow in Network in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML pCVE-2026-76022 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Buffer overflow in Network in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 20, 2026Use after free in Chromoting in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted networCVE-2026-76017 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Chromoting in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 20, 2026A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM).CVE-2026-73137 · Other software · Red Hat · reported by Red HatHigh 7.7
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `GetSecret()` function in the HelmRelease controller to fetch sensitive credentials from any namespace, which are then sent to an attacker-controlled Helm repository. This can lead to the exfiltration of credentials from arbitrary namespace Secrets, resulting in information disclosure.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 20, 2026A flaw was found in the multicloud-operators-subscription component.CVE-2026-67567 · Other software · Red Hat · reported by Red HatCritical 9.9
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper validation. This enables the tenant to deploy arbitrary resources across the entire cluster, leading to a significant security compromise.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 20, 2026A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any applicCVE-2026-43798 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1.
- Product
- swift-nio-ssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcCVE-2026-9033 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 6
An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.
- Product
- ER7212PC v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordomadanetworks.comomadanetworks.com
Aug 20, 2026hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configuration fields taken from a .cfg file in unchecked 32-bit int CVE-2026-72852 · Other software · hank-ai · reported by VulnCheckHigh 8.5
hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configuration fields taken from a .cfg file in unchecked 32-bit int arithmetic. In src-lib/convolutional_layer.cpp, l.nweights is computed as (c / groups) * n * size * size and l.outputs as l.out_h * l.out_w * l.out_c, and both feed xcalloc directly. A .cfg whose true dimension product exceeds INT_MAX wraps to a small or zero value, so the allocation is undersized; for example width and height of 256 with filters of 65536 gives 2^32, which wraps to 0. forward_convolutional_layer then re-derives the GEMM dimensions with a different operand order, computing k as l.size*l.size*l.c / l.groups where the allocation divided before multiplying, and reads and writes through the undersized buffer. Loading the crafted .cfg for inference or training is sufficient and no valid .weights file is required. The reported proof of concept observed a heap buffer overflow read in gemm_nn_fast under AddressSanitizer and glibc allocator metadata corruption in a release build of the same input, indicating an out-of-bounds write.
- Product
- darknet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026A flaw was found in Lighthouse.CVE-2026-66788 · Other software · Red Hat · reported by Red HatCritical 9.9
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 20, 2026A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes.CVE-2026-66787 · Other software · Red Hat · reported by Red HatHigh 8.7
A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 20, 2026A flaw was found in Submariner.CVE-2026-66785 · Other software · Red Hat · reported by Red HatHigh 8.7
A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious cluster, enabling it to declare arbitrary network ranges. Consequently, all network traffic intended for these arbitrary ranges from peer clusters will be rerouted through the attacker's tunnel, potentially leading to unauthorized information disclosure or network disruption.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 20, 2026Mongoose is an embedded web server and network library.CVE-2026-73259 · Other software · cesanta · reported by GitHubMedium 5.4
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http.c places the decoded request URI into the title and h1 elements without HTML entity encoding. The resulting reflected cross-site scripting executes in the Mongoose origin and can expose session data or perform actions as the victim. This issue is fixed in version 7.22.
- Product
- mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Mongoose is an embedded web server and network library.CVE-2026-73258 · Other software · cesanta · reported by GitHubMedium 6.5
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.
- Product
- mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Mongoose is an embedded web server and network library.CVE-2026-73257 · Other software · cesanta · reported by GitHubCritical 9.1
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.
- Product
- mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Mongoose is an embedded web server and network library.CVE-2026-73256 · Other software · cesanta · reported by GitHubCritical 9.1
Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-eight condition even though mg_http_parse() requires an eight-byte protocol string, so is_http_1_0 is never set. Mongoose consequently processes chunked encoding that an HTTP/1.0 proxy can ignore, enabling request smuggling and unauthorized access or state changes. This issue is fixed in version 7.22.
- Product
- mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Mongoose is an embedded web server and network library.CVE-2026-73255 · Other software · cesanta · reported by GitHubMedium 6.5
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mg_ssi() function in src/ssi.c concatenates the directive argument into a filesystem path without calling mg_path_is_sane(), allowing an MG_ENABLE_SSI deployment with ssi_pattern configured to disclose files readable by the Mongoose process. This issue is fixed in version 7.22.
- Product
- mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Mongoose is an embedded web server and network library.CVE-2026-73254 · Other software · cesanta · reported by GitHubMedium 5.4
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22.
- Product
- mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Mongoose is an embedded web server and network library.CVE-2026-73253 · Other software · cesanta · reported by GitHubCritical 9.1
Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions in src/tls_builtin.c call mg_match(), whose wildcard can cross DNS label boundaries, so a pattern such as *.example.com can match foo.bar.example.com. The resulting hostname verification bypass permits interception and modification of TLS traffic. This issue is fixed in version 7.22.
- Product
- mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Mongoose is an embedded web server and network library.CVE-2026-73251 · Other software · cesanta · reported by GitHubCritical 9.3
Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tls_builtin.c, the mg_tls_init() function stores the bundle in tls->ca_bundle_der while tls->ca_der.len remains zero, and mg_tls_recv_cert() uses tls_bundle_find() to accept a Common Name match without calling mg_tls_verify_cert_signature(). A forged self-signed certificate can therefore satisfy hostname and CertificateVerify checks and enable interception, credential disclosure, traffic modification, and malicious responses. This issue is fixed in version 7.23.
- Product
- mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702.CVE-2026-76591 · Other software · TRENDnet · reported by VulDBLow 2.1
A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702. This affects the function log_email_server of the file /cgi-bin/email.cgi of the component ssi. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
- Product
- TEW-755AP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026A vulnerability was identified in TRENDnet TEW-755AP up to 20260702.CVE-2026-76590 · Other software · TRENDnet · reported by VulDBHigh 8.6
A vulnerability was identified in TRENDnet TEW-755AP up to 20260702. Affected by this issue is some unknown functionality of the file /cgi-bin/wan.cgi of the component ssi. Such manipulation of the argument cameo.wan.wan_pppoe_password_00 leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
- Product
- TEW-755AP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026A vulnerability was found in TRENDnet TEW-755AP up to 20260702.CVE-2026-76589 · Other software · TRENDnet · reported by VulDBHigh 8.6
A vulnerability was found in TRENDnet TEW-755AP up to 20260702. Affected is the function FUN_401000 of the file /sbin/mycli. The manipulation of the argument ssid results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.
- Product
- TEW-755AP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the conCVE-2026-76403 · Other software · Splunk · reported by psirt@cisco.comHigh 7.4
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with Hypertext Transfer Protocol (HTTP) Event Collector in Splunk Enterprise. The vulnerability is possible because the Kerberos authentication path does not apply the configured certificate validation options when it builds the HTTP client. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka), Security configurations for Splunk Connect for Kafka (https://help.splunk.com/en/splunk-enterprise/get-data-in/splunk-connect-for-kafka/2.2/configure/security-configurations-for-splunk-connect-for-kafka), and Set up and use HTTP Event Collector with configuration files (https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files) in the Splunk documentation.
- Product
- Splunk Connect for Kafka
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a SafCVE-2026-76372 · Other software · Splunk · reported by psirt@cisco.comMedium 6.6
In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system through Nmap Scripting Engine scripts. The vulnerability is possible because the Nmap Scanner connector action manifest classifies the scan network action as read-only even though the action accepts script parameters that can perform write operations. For more information see Manage settings for a playbook in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.
- Product
- Nmap Scanner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk RepresentatiCVE-2026-76362 · Other software · Splunk · reported by psirt@cisco.comHigh 7.4
In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer (REST) server could access or modify all relevant data exchanged through that credential manager. The vulnerability is possible because the CyberArk REST client does not verify server certificates by default. The attack requires the attacker to have network-path interception capability between Splunk SOAR and the configured CyberArk REST server. For more information see Manage your organization's credentials with a password vault (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/configure-administration-settings-in-splunk-soar-cloud/manage-your-organizations-credentials-with-a-password-vault) in the Splunk documentation.
- Product
- Splunk SOAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2026-69550 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
- Product
- Windows App for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026A flaw was found in search-indexer.CVE-2026-76827 · Other software · Red Hat · reported by Red HatMedium 6.8
A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 19, 2026A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03.CVE-2026-76584 · Other software · TRENDnet · reported by VulDBHigh 8.6
A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation of the argument Currenttime results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
- Product
- TV-IP751WIC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026A vulnerability was identified in TRENDnet TV-IP751WIC 11.03.03.CVE-2026-76583 · Other software · TRENDnet · reported by VulDBLow 2.1
A vulnerability was identified in TRENDnet TV-IP751WIC 11.03.03. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
- Product
- TV-IP751WIC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05.CVE-2026-76582 · Other software · TRENDnet · reported by VulDBLow 2.1
A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected is the function popen/system of the file /cgi-bin/ping.cgi of the component ssi. Executing a manipulation of the argument ipaddr can lead to command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- TEW-821DAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026A flaw was found in acm-operator-bundle.CVE-2026-76139 · Other software · Red Hat · reported by Red HatHigh 8
A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 19, 2026Netty is an asynchronous, event-driven network application framework.CVE-2026-75596 · Other software · netty · reported by GitHubHigh 8.7
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Netty is an asynchronous, event-driven network application framework.CVE-2026-75595 · Other software · netty · reported by GitHubCritical 9.1
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026A flaw was found in mce-operator-bundle.CVE-2026-75569 · Other software · Red Hat · reported by Red HatHigh 7.7
A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.
- Product
- multicluster engine for Kubernetes 2.10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.