Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

518new WordPress flaws this week

395,110entries in the database

17,298 results · page 68 of 346

May 6, 2026HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability.CVE-2025-31957 · Other software · HCL Software · reported by psirt@hcl.comLow 2.6
HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 6, 2026In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline ManageCVE-2026-43237 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 This commit simplifies the amdgpu_gem_va_ioctl function, key updates include: - Moved the logic for managing the last update fence directly into amdgpu_gem_va_update_vm. - Introduced checks for the timeline point to enable conditional replacement or addition of fences. v2: Addressed review comments from Christian. v3: Updated comments (Christian). v4: The previous version selected the fence too early and did not manage its reference correctly, which could lead to stale or freed fences being used. This resulted in refcount underflows and could crash when updating GPU timelines. The fence is now chosen only after the VA mapping work is completed, and its reference is taken safely. After exporting it to the VM timeline syncobj, the driver always drops its local fence reference, ensuring balanced refcounting and avoiding use-after-free on dma_fence. Crash signature: [ 205.828135] refcount_t: underflow; use-after-free. [ 205.832963] WARNING: CPU: 30 PID: 7274 at lib/refcount.c:2
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
May 6, 2026In the Linux kernel, the following vulnerability has been resolved: team: avoid NETDEV_CHANGEMTU event when unregistering slave syzbot is reporting unregisCVE-2026-43234 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: team: avoid NETDEV_CHANGEMTU event when unregistering slave syzbot is reporting unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3 ref_tracker: netdev@ffff88807dcf8618 has 1/2 users at __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline] netdev_hold include/linux/netdevice.h:4429 [inline] inetdev_init+0x201/0x4e0 net/ipv4/devinet.c:286 inetdev_event+0x251/0x1610 net/ipv4/devinet.c:1600 notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85 call_netdevice_notifiers_mtu net/core/dev.c:2318 [inline] netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9886 netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9907 dev_set_mtu+0x126/0x260 net/core/dev_api.c:248 team_port_del+0xb07/0xcb0 drivers/net/team/team_core.c:1333 team_del_slave drivers/net/team/team_core.c:1936 [inline] team_device_event+0x207/0x5b0 drivers/net/team/team_core.c:2929 notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline] call_netdevice_notifiers net/core/dev.c:2295 [
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
May 5, 2026Masa CMS is an open source content management system.CVE-2026-40331 · Other software · MasaCMS · reported by GitHubCritical 9.3
Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, the unauthenticated JSON API accepts an altTable parameter that is stored via the setAltTable() method without validation or sanitization. This value is injected directly into a SQL FROM clause within feedGateway.cfc. An unauthenticated attacker can pass an arbitrary subquery into the altTable parameter to read sensitive data from any table in the database in a single HTTP request, including administrative credentials and password reset tokens. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, apply validation to the setAltTable function in core/mura/content/feed/feedBean.cfc to restrict input to simple alphanumeric table names, or disable the JSON API if it is not required.
Product
MasaCMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
May 5, 2026Masa CMS is an open source content management system.CVE-2026-40330 · Other software · MasaCMS · reported by GitHubCritical 9.3
Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's handling of the sortDirection parameter. The parameter value is concatenated directly into SQL queries without sanitization or parameterization. An unauthenticated remote attacker can exploit this to extract sensitive information, modify or delete database records, or potentially achieve remote code execution on the underlying database server. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, use a WAF to block or restrict access to the beanFeed.cfc component, or deploy rules to detect SQL injection patterns targeting the sortDirection parameter.
Product
MasaCMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
May 5, 2026Masa CMS is an open source content management system.CVE-2026-40329 · Other software · MasaCMS · reported by GitHubCritical 9.3
Masa CMS is an open source content management system. In versions 7.5.2 and earlier, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's processing of the sortBy parameter. The application fails to properly sanitize or parameterize this input before incorporating it into dynamic SQL statements. An unauthenticated remote attacker can execute arbitrary SQL commands against the database, potentially gaining access to sensitive data, modifying or deleting records, or escalating privileges to administrative control. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, configure WAF rules to block malicious SQL patterns in the sortBy parameter sent to beanFeed.cfc.
Product
MasaCMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
May 4, 2026Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before 2.6.2034.0 allows aCVE-2026-7791 · Other software · Amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.5
Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before 2.6.2034.0 allows a local non-admin authenticated user to place arbitrary files into arbitrary locations bypassing file system permission protections, leading to local privilege escalation to SYSTEM.
Product
Workspaces
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aws.amazon.com
May 4, 2026Beets is the media library management system.CVE-2026-42052 · Other software · beetbox · reported by GitHubMedium 6
Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode <%= ... %> for untrusted metadata fields. In this runtime, <%= ... %> is raw insertion and HTML escaping is only performed by <%- ... %>. Rendered output is then inserted with .html(...), allowing attacker-controlled markup to become active DOM. This issue has been patched in version 2.10.0.
Product
beets
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 4, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tegsoft Management and Information Services Trade Limited CVE-2025-14320 · Other software · Tegsoft Management and Information Services Trade Limited Company · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tegsoft Management and Information Services Trade Limited Company Online Support Application allows Reflected XSS. This issue affects Online Support Application: from V3 through 31122025.
Product
Online Support Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
May 4, 2026A vulnerability was determined in Shandong Hoteam Software PDM Product Data Management System up to 8.3.9.CVE-2026-7727 · Other software · Shandong Hoteam Software · reported by VulDBMedium 6.9
A vulnerability was determined in Shandong Hoteam Software PDM Product Data Management System up to 8.3.9. This affects the function GetQueryMachineGridOnePageData of the file /Base/BaseService.asmx/DataService. This manipulation of the argument SortOrder causes sql injection. The attack can be initiated remotely. Upgrading to version 8.3.10 is able to mitigate this issue. You should upgrade the affected component.
Product
PDM Product Data Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record en.hoteamsoft.com ucn9h68n9289.feishu.cn
May 3, 2026A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0.CVE-2026-7698 · Other software · Tiandy · reported by VulDBMedium 5.5
A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Affected by this vulnerability is an unknown functionality of the file /Easy7/rest/systemInfo/updateDbBackupInfo. Such manipulation of the argument week leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Product
Easy7 Integrated Management Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ucn9h68n9289.feishu.cn vuldb.com
May 3, 2026A flaw has been found in Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System 1.3.0.CVE-2026-7694 · Other software · Acrel Electrical · reported by VulDBMedium 5.5
A flaw has been found in Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System 1.3.0. The impacted element is an unknown function of the file /SubstationWEBV2/main/elecMaxMinAvgValue. Executing a manipulation of the argument fCircuitids can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Product
ECEMS Enterprise Microgrid Energy Efficiency Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ucn9h68n9289.feishu.cn vuldb.com
May 1, 2026A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execute arbitrary commandsCVE-2026-26461 · Other software · reported by MITREMedium 6.5
A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execute arbitrary commands via a crafted web request.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com aver.com
Apr 30, 2026IBM Turbonomic prometurbo agent 8.16.0 through 8.17.6 IBM Turbonomic Application Resource Management grants excessive cluster‑wide permissions, including unrestCVE-2026-6389 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Turbonomic prometurbo agent 8.16.0 through 8.17.6 IBM Turbonomic Application Resource Management grants excessive cluster‑wide permissions, including unrestricted read access to all secrets. An attacker that compromises the operator or its service account can exfiltrate sensitive credentials, escalate privileges, and potentially achieve full cluster compromise.
Product
Turbonomic prometurbo agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
Apr 30, 2026Assertion failure vulnerability in the PCO (Protocol Configuration Options) parser in the SMF (Session Management Function) component of Open5GS before v2.7.5 aCVE-2025-56568 · Other software · reported by MITREHigh 7.5
Assertion failure vulnerability in the PCO (Protocol Configuration Options) parser in the SMF (Session Management Function) component of Open5GS before v2.7.5 allows remote attackers to cause denial of service via specially crafted NGAP messages containing malformed length fields in protocol configuration data.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 30, 2026Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radiusCVE-2025-71284 · Other software · Synway Information Engineering Co., Ltd. · reported by VulnCheckCritical 9.3
Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject arbitrary shell commands by submitting a POST request with crafted radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters along with save=1 and enable_radius=1 to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 (UTC).
Product
Synway SMG Gateway Management Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com mp.weixin.qq.com
Apr 30, 2026A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0.CVE-2026-36960 · Other software · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0. The device does not implement CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints. If an authenticated administrator visits the malicious webpage, the victim's browser automatically includes the valid session cookie in the request, allowing the router to process the request as a legitimate administrative action.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 30, 2026A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0.CVE-2026-36956 · Other software · Dbitnet · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0. The router fails to implement proper CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints such as /api/setWlan. If an authenticated administrator visits the malicious webpage, the victim's browser automatically includes the valid session cookie in the request, allowing the router to process the request as a legitimate administrative action.
Product
Dbit N300 T1 Pro Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 29, 2026An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with anCVE-2026-6915 · Other software · MongoDB · reported by cna@mongodb.comMedium 5.3
An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account.
Product
MongoDB Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.mongodb.org
Apr 29, 2026A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions.CVE-2026-0204 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 8
A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions.
Product
SonicOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com
Apr 29, 2026Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research InstitCVE-2026-6849 · Other software · TUBITAK BILGEM Software Technologies Research Institute · reported by iletisim@usom.gov.trHigh 8.8
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus OS My Computer allows OS Command Injection. This issue affects Pardus OS My Computer: from <=0.7.5 before 0.8.0.
Product
Pardus OS My Computer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Apr 29, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus SCVE-2026-5166 · Other software · TUBITAK BILGEM Software Technologies Research Institute · reported by iletisim@usom.gov.trCritical 9.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Path Traversal. This issue affects Pardus Software Center: before 0.6.4.
Product
Pardus Software Center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Apr 29, 2026Improper link resolution before file access ('link following') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows SymlCVE-2026-5161 · Other software · TUBITAK BILGEM Software Technologies Research Institute · reported by iletisim@usom.gov.trHigh 8.8
Improper link resolution before file access ('link following') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Symlink Attack. This issue affects Pardus About: before 1.2.2.
Product
Pardus About
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Apr 29, 2026Improper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute CVE-2026-5141 · Other software · TUBITAK BILGEM Software Technologies Research Institute · reported by iletisim@usom.gov.trHigh 8.8
Improper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Hijacking a privileged process. This issue affects Pardus Software Center: from 1.0.2 before 1.0.3.
Product
Pardus Software Center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Apr 29, 2026Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows AutheCVE-2026-5140 · Other software · TUBITAK BILGEM Software Technologies Research Institute · reported by iletisim@usom.gov.trHigh 8.8
Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Authentication Bypass. This issue affects Pardus Update: from 0.6.3 before 0.6.4.
Product
Pardus Update
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Apr 29, 2026This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript.CVE-2026-42518 · Other software · CDAC-Noida · reported by vdisclose@cert-in.org.inHigh 8.7
This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticated remote attacker could exploit this vulnerability by accessing the client-side code to extract sensitive information and cryptographic keys. Successful exploitation of this vulnerability could lead to exposure of sensitive data and compromise of cryptographic protections on the targeted system.
Product
e-Sushrut, Hospital Management Information System (HMIS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in
Apr 29, 2026This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting sensitive data.CVE-2026-42517 · Other software · CDAC-Noida · reported by vdisclose@cert-in.org.inHigh 7.1
This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting sensitive data. An authenticated attacker could exploit this vulnerability by decoding and manipulating Base64-encoded parameters in the request URL to gain unauthorized access to sensitive information on the targeted system.
Product
e-Sushrut, Hospital Management Information System (HMIS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in
Apr 29, 2026This vulnerability exists in e-Sushrut due to improper authorization checks during resource access.CVE-2026-42516 · Other software · CDAC-Noida · reported by vdisclose@cert-in.org.inHigh 7.1
This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated attacker could exploit this vulnerability by manipulating encoded parameters in the request URL to gain unauthorized access to patient accounts on the targeted system.
Product
e-Sushrut, Hospital Management Information System (HMIS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in
Apr 29, 2026This vulnerability exists in e-Sushrut due to improper access control in resource access validation.CVE-2026-42515 · Other software · CDAC-Noida · reported by vdisclose@cert-in.org.inHigh 7.1
This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability by manipulating parameter in the API request URL to gain unauthorized access to sensitive information of patients on the targeted system.
Product
e-Sushrut, Hospital Management Information System (HMIS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in
Apr 29, 2026This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses.CVE-2026-42514 · Other software · CDAC-Noida · reported by vdisclose@cert-in.org.inHigh 8.8
This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses. A remote attacker could exploit this vulnerability by intercepting API responses containing valid OTPs. Successful exploitation of this vulnerability could allow an attacker to impersonate the target user and gain unauthorized access to user accounts on the targeted system.
Product
e-Sushrut, Hospital Management Information System (HMIS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in
Apr 29, 2026This vulnerability exists in e-Sushrut due to improper authentication logic that relies on client-side response parameters to determine authentication status.CVE-2026-42513 · Other software · CDAC-Noida · reported by vdisclose@cert-in.org.inHigh 8.8
This vulnerability exists in e-Sushrut due to improper authentication logic that relies on client-side response parameters to determine authentication status. A remote attacker could exploit this vulnerability by intercepting and modifying the server response. Successful exploitation of this vulnerability could allow the attacker to bypass authentication and gain unauthorized access to user accounts on the targeted system.
Product
e-Sushrut, Hospital Management Information System (HMIS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in
Apr 29, 2026Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the installation restriCVE-2026-21023 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.9
Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the installation restriction of specific application.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Apr 28, 2026A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated remote attackers to execute arbitrary JavaCVE-2026-37750 · Other software · reported by MITREMedium 6.1
A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated remote attackers to execute arbitrary JavaScript in victim's browsers via the unsanitized type parameter in register.php.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 28, 2026OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation.CVE-2026-42421 · Other software · OpenClaw · reported by VulnCheckLow 2.3
OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can maintain unauthorized access to WebSocket connections after token rotation by exploiting the failure to disconnect existing shared-token sessions.
Product
OpenClaw
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 28, 2026OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload.CVE-2026-41916 · Other software · OpenClaw · reported by VulnCheckLow 2.3
OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through config reload operations.
Product
OpenClaw
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 28, 2026OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup migration treats empty-array settings as missing values.CVE-2026-41388 · Other software · OpenClaw · reported by VulnCheckMedium 6.3
OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup migration treats empty-array settings as missing values. Attackers can restart the application to rehydrate revoked Tlon configuration from file state, bypassing intended revocation controls.
Product
OpenClaw
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 28, 2026NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypCVE-2026-24178 · Other software · NVIDIA · reported by psirt@nvidia.comCritical 9.8
NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information disclosure, code execution, and denial of service.
Product
FLARE SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvd.nist.gov nvidia.custhelp.com
Apr 28, 2026Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings.CVE-2025-48431 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.
Product
Apache Thrift
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Apr 27, 2026Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalidaCVE-2026-5942 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 5.5
Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalidated objects and crash the program.
Product
Foxit PDF Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxit.com
Apr 27, 2026Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of sCVE-2026-5938 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 5.5
Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service.
Product
Foxit PDF Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxit.com
Apr 27, 2026TheGem Theme Elements (for Elementor): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42410 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows DOM-Based XSS.This issue affects TheGem Theme Elements (for Elementor): from n/a before 5.12.1.1.
Product
TheGem Theme Elements (for Elementor)
Fixed in
5.12.1.1
What to do
Update TheGem Theme Elements (for Elementor) to 5.12.1.1 or newer.
Full record and what to do →NVD record patchstack.com
Apr 27, 2026When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path sucCVE-2026-40022 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.2
When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer classes derive the authentication path from properties.getPath() when camel.server.authenticationPath / camel.management.authenticationPath is not explicitly set. Combined with the Vert.x sub-router mounting model - the sub-router is mounted at _path_* and the authentication handler is registered inside the sub-router at the resolved path - this causes the authentication handler to match only the exact configured context path, not its subpaths. Unauthenticated requests to subpaths such as /api/_route_ or /admin/observe/info therefore reach protected business routes and management endpoints without being challenged for credentials. The /observe/info endpoint can disclose runtime metadata such as the user, working directory, home directory, process ID, JVM and operating system information. This issue affects Apache Camel: from 4.14.1 before 4.14.6, from 4.18.0 before 4.18.2. User
Product
Apache Camel Platform HTTP Main
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record camel.apache.org openwall.com
Apr 27, 2026An improper ownership management vulnerability has been identified in Moxa’s Secure Router.CVE-2026-3867 · Other software · Moxa · reported by psirt@moxa.comMedium 6
An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration file containing the hashed password of the administrative account. Successful exploitation of this vulnerability could allow an attacker to obtain sensitive information. Exploitation is only possible under a specific condition — when the configuration file has been exported. This vulnerability does not impact the integrity or availability of the affected product, and no confidentiality, integrity, or availability impact to the subsequent system has been identified.
Product
EDR-8010 Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record moxa.com
Apr 26, 2026A vulnerability was detected in CodePanda Source canteen_management_system 1.0.CVE-2026-7072 · Other software · CodePanda Source · reported by VulDBMedium 5.5
A vulnerability was detected in CodePanda Source canteen_management_system 1.0. Affected by this issue is some unknown functionality of the file /api/login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
Product
canteen_management_system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Apr 26, 2026P10 Central Management Software 1.4.13 contains a buffer overflow vulnerability in the login password field that allows local attackers to crash the applicationCVE-2018-25296 · Other software · P10 · reported by VulnCheckMedium 6.8
P10 Central Management Software 1.4.13 contains a buffer overflow vulnerability in the login password field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 2000-byte payload into the password field and click login to trigger an application crash and denial of service.
Product
Central Management Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ambientweather.com exploit-db.com
Apr 24, 2026SiYuan is an open-source personal knowledge management system.CVE-2026-41894 · Other software · siyuan-note · reported by GitHubHigh 7.1
SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, the fix for CVE-2026-30869 only added a denylist check (IsSensitivePath) but did not address the root cause — a redundant url.PathUnescape() call in serveExport(). An authenticated attacker can use double URL encoding (%252e%252e) to traverse directories and read arbitrary workspace files including the full SQLite database (siyuan.db), kernel log, and all user documents. This vulnerability is fixed in 3.6.5.
Product
siyuan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 24, 2026SiYuan is an open-source personal knowledge management system.CVE-2026-41421 · Other software · siyuan-note · reported by GitHubHigh 8.8
SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, SiYuan desktop renders notification messages as raw HTML inside an Electron renderer. The notification route POST /api/notification/pushMsg accepts a user-controlled msg value, forwards it through the backend broadcast layer, and the frontend inserts it into the DOM with insertAdjacentHTML(...) at message.ts. On desktop builds, this is not limited to ordinary XSS. Electron windows are created with nodeIntegration: true, contextIsolation: false, and webSecurity: false at main.js. As a result, JavaScript executed from the notification sink can directly access Node APIs and escalate to desktop code execution. This vulnerability is fixed in 3.6.5.
Product
siyuan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 24, 20264ga Boards is a boards system for realtime project management.CVE-2026-41419 · Other software · RARgames · reported by GitHubHigh 7.6
4ga Boards is a boards system for realtime project management. Prior to 3.3.5, a path traversal vulnerability allows an authenticated user with board import privileges to make the server ingest arbitrary host files as board attachments during BOARDS archive import. Once imported, the file can be downloaded through the normal application interface, resulting in unauthorized local file disclosure. This vulnerability is fixed in 3.3.5.
Product
4gaBoards
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 24, 20264ga Boards is a boards system for realtime project management.CVE-2026-41418 · Other software · RARgames · reported by GitHubMedium 5.3
4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnerable to user enumeration via a timing side-channel in the login endpoint (POST /api/access-tokens). When an invalid username/email is provided, the server responds immediately (~17ms average). When a valid username/email is provided with an incorrect password, the server first performs a bcrypt.compareSync() operation (~74ms average) before responding. This ~4.4× timing difference is trivially detectable even over a network — a single request suffices. This vulnerability is fixed in 3.3.5.
Product
4gaBoards
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Apr 23, 2026Kirby is an open-source content management system.CVE-2026-41325 · Other software · getkirby · reported by GitHubHigh 7.1
Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). It is also possible to customize the permissions for each target model in the model blueprints (such as in `site/blueprints/pages/...`) using the `options` feature. The permissions and options together control the authorization of user actions. Kirby provides the `pages.create`, `files.create` and `users.create` permissions (among others). These permissions can again be set in the user blueprint and/or in the blueprint of the target model via `options`. Prior to versions 4.9.0 and 5.4.0, Kirby allowed to override the `options` during the creation of pages, files and users by injecting custom dynamic blueprint configuration into the model data. The injected `options` could include `'create' => true`, which then caused an override of the permissions and options configured by the site developer in the user and model blueprints. The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. The patched versions have updated th
Product
kirby
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.