Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,412 results · page 7 of 149
Sep 29, 2026simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript.CVE-2026-102829 · Other software · steveukx · reported by GitHubCritical 9.2
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it as allowUnsafeEditor. A consuming application that forwards attacker-influenced environment values can therefore allow Git to invoke an attacker-selected editor during operations such as commit amendment or interactive rebase when no higher-priority editor setting overrides VISUAL and Git's terminal prerequisites are met. The executable runs with the privileges of the Node.js process. This issue is fixed in argv-parser 2.0.1.
- Product
- git-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript.CVE-2026-102828 · Other software · steveukx · reported by GitHubCritical 9.2
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.
- Product
- git-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript.CVE-2026-102827 · Other software · steveukx · reported by GitHubHigh 8.1
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can therefore bypass detectVulnerableFlags, reach git push against a local or file remote or an attacker-influenced receive-pack target, and cause Git to invoke an attacker-selected command in consumers that expose those arguments. The clone-side abbreviation handling does not protect the push path. This issue is fixed in 4.0.0.
- Product
- git-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript.CVE-2026-102826 · Other software · steveukx · reported by GitHubHigh 8.1
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a conditional include. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled file that the process can read. This issue is fixed in 4.0.0.
- Product
- git-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.CVE-2026-102677 · Other software · electron · reported by GitHubHigh 7.8
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.
- Product
- electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.CVE-2026-102676 · Other software · electron · reported by GitHubHigh 8.3
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
- Product
- electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.CVE-2026-102675 · Other software · electron · reported by GitHubHigh 7.4
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
- Product
- electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.CVE-2026-102674 · Other software · electron · reported by GitHubHigh 8.2
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
- Product
- electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.CVE-2026-102673 · Other software · electron · reported by GitHubHigh 8.2
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.
- Product
- electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions.CVE-2026-97711 · Other software · yahoo · reported by GitHubLow 2.3
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because SCRIPT_CLOSE_REGEXP can consume a second closing tag inside one match. When the serialized function is embedded in a script element, the surviving closing tag terminates the element early and causes the remaining output to be parsed as HTML, enabling cross-site scripting in the page origin. Only function values are affected; ordinary data values and options.isJSON output are unaffected. This issue is fixed in version 7.1.2.
- Product
- serialize-javascript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Use-after-free in the JavaScript Engine: JIT component.CVE-2026-100825 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Other issue in the JavaScript: WebAssembly component.CVE-2026-100817 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Incorrect boundary conditions in the JavaScript Engine: JIT component.CVE-2026-100814 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Invalid pointer in the JavaScript Engine: JIT component.CVE-2026-100813 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Use-after-free in the JavaScript: WebAssembly component.CVE-2026-100796 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026JIT miscompilation in the JavaScript Engine component.CVE-2026-100793 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026JIT miscompilation in the JavaScript: WebAssembly component.CVE-2026-100792 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.1
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Invalid pointer in the JavaScript: WebAssembly component.CVE-2026-100788 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Use-after-free in the JavaScript: WebAssembly component.CVE-2026-100776 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Use-after-free in the JavaScript: WebAssembly component.CVE-2026-100769 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Use-after-free in the JavaScript: WebAssembly component.CVE-2026-100765 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js).CVE-2026-102414 · Other software · browserify · reported by 7ffcee3d-2c14-4c3e-b844-86c6a321a158Medium 6.3
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (64 bytes, or 128 bytes for sha384 and sha512) is passed to HMAC as the key on every iteration, and HMAC hashes such keys in full each time. Cost is therefore O(iterations × password length), and a long password can block the event loop. The fallback is used by pbkdf2Sync and pbkdf2 on Node.js before 0.12, on Bun (1.0.0 through 1.1.34, and 1.2.6 and later), and on Deno 2.9.0 and later, because their native pbkdf2Sync fails the library's feature check. It is also used when lib/sync.js is imported directly. Node.js 0.12 and later, and browser builds (which use lib/sync-browser.js), are not affected. Applications that enforce a reasonable maximum password length are not meaningfully affected.
- Product
- pbkdf2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.CVE-2026-101916 · Other software · grpc · reported by GitHubHigh 7.4
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.
- Product
- grpc-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.CVE-2026-101915 · Other software · grpc · reported by GitHubLow 3.7
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.
- Product
- grpc-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.CVE-2026-101914 · Other software · grpc · reported by GitHubMedium 6.5
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.
- Product
- grpc-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.CVE-2026-101913 · Other software · beaugunderson · reported by GitHubMedium 6.3
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.
- Product
- ip-address
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.CVE-2026-101912 · Other software · beaugunderson · reported by GitHubMedium 6.3
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1.
- Product
- ip-address
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.CVE-2026-101911 · Other software · beaugunderson · reported by GitHubMedium 6.3
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.
- Product
- ip-address
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.CVE-2026-101910 · Other software · beaugunderson · reported by GitHubMedium 6.9
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1.
- Product
- ip-address
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud PlCVE-2026-81867 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cCritical 9.4
A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially crafted script bypassing param guards. This vulnerability was patched on 28 June 2026, and no customer action is needed.
- Product
- Application Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cloud.google.comdocs.cloud.google.com
Sep 26, 2026Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaCVE-2026-100695 · Other software · vrana · reported by VulnCheckMedium 5.3
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments where the database has FILE privileges and can write to the webroot, attackers can use the XSS to submit authenticated SQL requests that write PHP files via INTO DUMPFILE, achieving remote code execution as the web server account.
- Product
- adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 26, 2026SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScrCVE-2026-100643 · Other software · siyuan-note · reported by VulnCheckHigh 8.5
SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with nodeIntegration enabled, this leads to command execution with SiYuan process privileges.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 26, 2026AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript sCVE-2026-100630 · Other software · WWBN · reported by VulnCheckMedium 5.1
AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL() validation and are decoded by the browser to break out of the JavaScript string, executing arbitrary code in any visitor's session including administrators.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escapCVE-2026-100521 · Other software · Cotonti · reported by VulnCheckMedium 5.1
Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor who opens the link, including administrators.
- Product
- Cotonti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026CSS & JavaScript Toolbox: Stored Cross-Site ScriptingCVE-2025-14814 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- CSS & JavaScript Toolbox
- Affected
- up to 12.0.6
- What to do
- Affects up to 12.0.6. Update CSS & JavaScript Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 24, 2026Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds.CVE-2026-88388 · Other software · reported by MITREHigh 7.5
Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. A remote attacker can supply JavaScript input that triggers an exception and reaches jslPrintTokenLineMarker(), which passes the address of a 4-byte int column variable to jsvGetLineAndCol() as a size_t pointer. jsvGetLineAndCol() performs an 8-byte write through the mismatched pointer, overwriting adjacent stack memory.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structuresCVE-2026-14441 · Other software · Brocade · reported by sirt@brocade.comMedium 6.9
A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and prevent potential identity mismatch conditions.
- Product
- SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in oCVE-2026-48543 · Other software · krayin · reported by VulnCheckMedium 5.1
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form description containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected web form.
- Product
- laravel-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 24, 2026Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in oCVE-2026-48542 · Other software · krayin · reported by VulnCheckMedium 5.1
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attackers can craft a product name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected product record.
- Product
- laravel-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 24, 2026Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in oCVE-2026-48541 · Other software · krayin · reported by VulnCheckMedium 5.1
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected person record.
- Product
- laravel-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 24, 2026Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in oCVE-2026-48540 · Other software · krayin · reported by VulnCheckMedium 5.1
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected lead record.
- Product
- laravel-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 24, 2026An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0) allows crafted JavaScript input containing an overlong tokeCVE-2026-88390 · Other software · reported by MITREHigh 7.7
An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0) allows crafted JavaScript input containing an overlong token to trigger a one-byte write beyond the JsLex.token buffer in RELEASE/NO_ASSERT builds. The out-of-bounds write corrupts the adjacent tokenValue pointer, resulting in memory corruption and potentially causing application crashes or denial of service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A vulnerability was identified in java110 MicroCommunity up to 2.0.CVE-2026-96803 · Other software · java110 · reported by VulDBMedium 5.5
A vulnerability was identified in java110 MicroCommunity up to 2.0. Affected is the function QueryServiceSMOImpl.fallBack of the file BusinessApi.java of the component fallBack API Endpoint. Such manipulation of the argument fallBackSql leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- MicroCommunity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026JLine is a Java library for handling console input.CVE-2026-77423 · Other software · jline · reported by GitHubHigh 7.5
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool. This issue is fixed in versions 3.30.15 and 4.3.1.
- Product
- jline3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026JLine is a Java library for handling console input.CVE-2026-77422 · Other software · jline · reported by GitHubHigh 7.5
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.
- Product
- jline3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026JLine is a Java library for handling console input.CVE-2026-77421 · Other software · jline · reported by GitHubMedium 6.5
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1.
- Product
- jline3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026JLine is a Java library for handling console input.CVE-2026-77420 · Other software · jline · reported by GitHubMedium 5.5
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1.
- Product
- jline3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java.CVE-2026-61695 · Other software · square · reported by GitHubHigh 7.5
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.
- Product
- wire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Moquette is a lightweight Java MQTT broker.CVE-2026-95848 · Other software · moquette-io · reported by GitHubCritical 9.3
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.
- Product
- moquette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Moquette is a lightweight Java MQTT broker.CVE-2026-95847 · Other software · moquette-io · reported by GitHubHigh 8.8
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client's metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1.
- Product
- moquette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.