Updated 23 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

1,593 results · page 7 of 32

Aug 20, 2026OriginLab OriginPro OGW File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2026-18291 · Other software · OriginLab · reported by zdi-disclosures@trendmicro.comHigh 7.8
OriginLab OriginPro OGW File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OGW files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29334.
Product
OriginPro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.originlab.com zerodayinitiative.com
Aug 20, 2026OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2026-18290 · Other software · OriginLab · reported by zdi-disclosures@trendmicro.comHigh 7.8
OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29333.
Product
OriginPro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.originlab.com zerodayinitiative.com
Aug 20, 2026OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2026-18289 · Other software · OriginLab · reported by zdi-disclosures@trendmicro.comHigh 7.8
OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29332.
Product
OriginPro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.originlab.com zerodayinitiative.com
Aug 20, 2026OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2026-18288 · Other software · OriginLab · reported by zdi-disclosures@trendmicro.comHigh 7.8
OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-29331.
Product
OriginPro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.originlab.com zerodayinitiative.com
Aug 20, 2026HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers.CVE-2026-21784 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.8
HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation.
Product
IEM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 19, 2026Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the retCVE-2026-75628 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.7
Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter. oauth2_login reads the return parameter from the initiation request, runs same_origin_path over it, and stores the survivor in the session flow record as the post-login redirect target. That check rejects a value that does not begin with a slash, one with a slash as its second byte, and one containing CR or LF. A backslash and a tab pass. The URL Standard treats a backslash as equivalent to a slash for special schemes, so `/\evil.example` parses with the authority `evil.example`. It also strips ASCII tab before parsing, so a tab between two leading slashes leaves `//evil.example`. A crafted link to the application's own login route lands the victim on the attacker's site after a genuine authentication. The redirect carries no authorization code or access token.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record datatracker.ietf.org metacpan.org
Aug 19, 2026The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-biCVE-2026-49430 · Other software · FreeBSD · reported by secteam@freebsd.orgHigh 7.8
The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption via ZFS_IOC_RECV_NEW by sending a crafted receive stream in heal mode.
Product
FreeBSD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.freebsd.org
Aug 18, 2026Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page.CVE-2026-76041 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Aug 18, 2026Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins frCVE-2026-71573 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org joomla.org
Aug 18, 2026Same-origin policy bypass in the Graphics: ImageLib component.CVE-2026-74974 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Aug 18, 2026Same-origin policy bypass in the Audio/Video: Playback component.CVE-2026-74967 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Aug 18, 2026Same-origin policy bypass in the Networking: Cookies component.CVE-2026-74963 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Aug 18, 2026Same-origin policy bypass in the DOM: Service Workers component.CVE-2026-74956 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.1
Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Aug 17, 2026openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true.CVE-2026-74881 · Other software · jahlives · reported by VulnCheckHigh 7.1
openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them.
Product
openssl_encrypt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Aug 17, 2026SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks Origin/RefCVE-2026-74867 · Other software · siyuan-note · reported by VulnCheckLow 2.3
SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthorized actions on behalf of authenticated users by submitting requests with valid session cookies, relying on browser default SameSite policies rather than server-enforced protections.
Product
siyuan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Aug 17, 2026SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables originCVE-2026-74802 · Other software · siyuan-note · reported by VulnCheckHigh 7.1
SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attacker-chosen targets, enabling authenticated network pivoting through the victim's machine.
Product
siyuan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Aug 15, 2026In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdw_add_element_group_count found by syzkaller The original implemenCVE-2026-72488 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdw_add_element_group_count found by syzkaller The original implementation caused an out-of-bounds memory access in the sdw_add_element_group_count for-loop when i == num. for (i = 0; i <= num; i++) { if (rate == group->rates[i] && lane == group->lanes[i]) ... To fix this error, the function now checks for existing rate/lane entries in the group(a function parameter) using a for-loop before adding them. No functional changes apart from this fix.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Aug 15, 2026In the Linux kernel, the following vulnerability has been resolved: openrisc: Fix jump_label smp syncing The original commit 8c30b0018f9d ("openrisc: Add jumpCVE-2026-72154 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: openrisc: Fix jump_label smp syncing The original commit 8c30b0018f9d ("openrisc: Add jump label support") copies from arm64 and does not properly consider how icache invalidation on remote cores works in OpenRISC. On OpenRISC remote icaches need to be invalidated otherwise static key's may remain state after updating. Fix SMP cache syncing by: 1. Properly invalidate remote core icaches on SMP systems by using icache_all_inv. The old code uses kick_all_cpus_sync() which runs a no-op IPI function call on remote CPU's which does execute a lot of code and flushes many cache lines in the process, but does not flush all and it's not correct on OpenRISC. 2. For architectures that do not have WRITETHROUGH caches be sure to flush the dcache after patching. To test this I first reproduced the issue using a custom test module [0]. The test confirmed that some icache lines maintained stale static_key code sequences after calling static_branch_enable(). After this patch there are no longer jump_label coherency issues. [0] https://github.com/stffrdhrn/or1k-utils/tree/master/tests/smp_static_key_t
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Aug 15, 2026In the Linux kernel, the following vulnerability has been resolved: riscv: probes: save original sp in rethook trampoline Reading a word from the stack in a kCVE-2026-72028 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: riscv: probes: save original sp in rethook trampoline Reading a word from the stack in a kretprobe crashes a risc-v kernel. $ cd /sys/kernel/tracing/ $ echo 'r n_tty_write $stack0' > dynamic_events $ echo 1 > events/kprobes/enable Unable to handle kernel paging request at virtual address 0000000200000128 ... [<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38 [<ffffffff80177196>] process_fetch_insn+0x3ee/0x760 [<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0 [<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58 [<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90 [<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108 [<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c [<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94 [<ffffffff8067872a>] tty_write+0x1a/0x30 In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value. arch_rethook_trampoline saves the registers from the probed function in a struct pt_regs. sp is not saved. Instead, sp is decremented for arch_rethook_trampoline's local stack. Fix this crash and save the original sp along with the other registers. Use a0 a
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Aug 14, 2026Epeken All Kurir for Woocommerce: Does not verify that a payment-confirmation request originates from the owner of the targeted orderCVE-2026-16739 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid.
Product
Epeken All Kurir for Woocommerce
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Epeken All Kurir for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 13, 2026Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the cCVE-2026-18408 · Other software · Postgresql · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007High 8.8
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Product
Postgresql
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record postgresql.org
Aug 11, 2026Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network.CVE-2026-56179 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.3
Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network.
Product
Windows 11 Version 24H2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Aug 10, 2026A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assetsCVE-2026-72574 · Other software · picocms · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 6.1
A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.
Product
Pico
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 7, 2026WP Events Manager: Does not verify that an incoming payment notification originates from the site's configured merchant accountCVE-2026-15148 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings.
Product
WP Events Manager
Fixed in
2.2.5
What to do
Update WP Events Manager to 2.2.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data viCVE-2026-19167 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comLow 3.1
Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Aug 6, 2026Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data CVE-2026-19161 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comLow 3.1
Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Aug 6, 2026Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data CVE-2026-19160 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comLow 3.1
Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Aug 5, 2026Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, includingCVE-2026-66298 · Other software · livebook-dev · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.6
Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart. Livebook's JS-view feature renders notebook-defined JavaScript inside a sandboxed, cross-origin iframe specifically because that JavaScript is untrusted. The trusted iframe shell in iframe/priv/static/iframe/v5.html forwards every keydown event fired in its own window to the parent page without consulting Event.isTrusted, so an event synthesized by the untrusted script through window.dispatchEvent is forwarded exactly as a genuine keystroke would be. The parent-side relay in assets/js/hooks/js_view.js reconstructs and re-dispatches it on the live page with no further validation, and because assets/js/hooks/session.js registers the global shortcut handler on the document in the capture phase, that handler acts on the replicated event regardless of how it was produced. Sandboxed output JavaScript can therefore drive Livebook's session-wide keyboard shortcuts. Two of them reach LivebookWeb.SessionLive and execute immediately with no confirmation: the shortcut for queueing f
Product
livebook
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cna.erlef.org github.com
Aug 5, 2026GDPR Cookie Compliance: Expires the visitor's cookies from an action that is reachable without authentication and performs no request-origin checkCVE-2026-16613 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no request-origin check, allowing an attacker to log any user out and delete the site's cookies by luring them to a crafted link.
Product
GDPR Cookie Compliance
Fixed in
5.1.0
What to do
Update GDPR Cookie Compliance to 5.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, alCVE-2026-62927 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method.
Product
Eclipse Milo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com gitlab.eclipse.org
Aug 3, 2026Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.CVE-2026-66322 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Aug 3, 2026Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.CVE-2026-66318 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Aug 3, 2026Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.CVE-2026-66317 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Aug 3, 2026Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.CVE-2026-66316 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Aug 3, 2026Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.CVE-2026-66313 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Aug 1, 2026guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers.CVE-2026-67339 · Other software · guzzle · reported by VulnCheckMedium 6.9
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections.
Product
guzzle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Aug 1, 2026better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains.CVE-2025-71403 · Other software · better-auth · reported by VulnCheckHigh 7.1
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.
Product
better-auth
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Aug 1, 2026YOP Poll: Does not validate the connection's origin IP address and instead trusts client-controlled forwarding headersCVE-2026-14840 · WordPress plugins & themes · reported by WPScanMedium 5.3
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.
Product
YOP Poll
Fixed in
7.0.6
What to do
Update YOP Poll to 7.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Jul 29, 2026Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.CVE-2026-18019 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Jul 29, 2026Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTMLCVE-2026-17984 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comLow 3.3
Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Jul 29, 2026Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted CVE-2026-17982 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Jul 29, 2026Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.CVE-2026-17981 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Jul 29, 2026Policy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.CVE-2026-17977 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Policy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Jul 29, 2026Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.CVE-2026-17963 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Jul 29, 2026Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.CVE-2026-17959 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Jul 29, 2026Policy bypass in MHTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted MHTML page.CVE-2026-17954 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Policy bypass in MHTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted MHTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Jul 29, 2026Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.CVE-2026-17949 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Jul 29, 2026Side-channel information leakage in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.CVE-2026-17942 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Side-channel information leakage in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Jul 29, 2026Inappropriate implementation in DOMStorage in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.CVE-2026-17933 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Inappropriate implementation in DOMStorage in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Jul 29, 2026Inappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pageCVE-2026-17928 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Inappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.