Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,742 results · page 7 of 75
Sep 14, 2026Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive CVE-2026-14259 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest team member to create Open or Private boards despite administrator restrictions via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00712
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block creationCVE-2026-13417 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a child block whose `fields.properties` is a non-object value. Mattermost Advisory ID: MMSA-2026-00710
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing pCVE-2026-12882 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content. Mattermost Advisory ID: MMSA-2026-00703
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being proceCVE-2026-11993 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files, which allows a user with permission to upload files to spawn more goroutines than intended and block the indexing of other files via uploading heavy files constantly to the server.. Mattermost Advisory ID: MMSA-2026-00696
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notificatCVE-2026-10556 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.3
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership which allows channel manCVE-2026-10542 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership which allows channel managers to update actions in other channels via the channel action update endpoint.. Mattermost Advisory ID: MMSA-2026-00692
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026A vulnerability was determined in GPAC up to f1219cde.CVE-2026-90687 · Other software · reported by VulDBLow 2.1
A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gf_node_changed_internal of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is able to resolve this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows attackers to stop Windows.CVE-2026-16726 · Other software · panasonic · reported by product-security@gg.jp.panasonic.comMedium 6.8
Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows attackers to stop Windows.
- Product
- PANATERM v6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordindustry.panasonic.com
Sep 13, 2026A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04.CVE-2026-90620 · Other software · 0x4m4 · reported by VulDBMedium 5.5
A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrike_server.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- HexStrike AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2026A vulnerability was determined in GPAC up to f1219cde.CVE-2026-90611 · Other software · reported by VulDBLow 1.9
A vulnerability was determined in GPAC up to f1219cde. This impacts the function xmt_parse_element of the file scene_manager/loader_xmt.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 will fix this issue. This patch is called afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2026A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0.CVE-2026-90602 · Other software · Anil-matcha · reported by VulDBMedium 5.1
A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.
- Product
- Open-Generative-AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2026A vulnerability was determined in embedded-graphics up to 0.8.2.CVE-2026-90593 · Other software · reported by VulDBMedium 6.9
A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::draw_sub_image of the file src/image/image_raw.rs. Executing a manipulation of the argument width can lead to integer overflow. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2026A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2.CVE-2026-90581 · Other software · cym1102 · reported by VulDBLow 2.1
A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
- Product
- nginxWebUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2026A vulnerability was determined in davenardella snap7 up to 1.4.3.CVE-2026-90572 · Other software · davenardella · reported by VulDBLow 2
A vulnerability was determined in davenardella snap7 up to 1.4.3. The affected element is the function TSnap7MicroClient::opUpload of the file src/core/s7_micro_client.cpp. Executing a manipulation of the argument DataLen can lead to memory corruption. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- snap7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2026A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0.CVE-2026-90563 · Other software · maliangnansheng · reported by VulDBMedium 5.1
A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. This affects the function utils.toToc of the file ArticleController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely.
- Product
- bbs-springboot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2026A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d.CVE-2026-90522 · Other software · jaychouchannel · reported by VulDBMedium 5.5
A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Patch name: 9cb6215ac871f99a90cde763cf003e95ff282283. It is recommended to apply a patch to fix this issue.
- Product
- Tourism-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2026A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46.CVE-2026-90506 · Other software · vvbbnn00 · reported by VulDBLow 1.3
A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This impacts an unknown function of the component Save Account Job. This manipulation causes race condition. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- WARP-Clash-API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 13, 2026A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11.CVE-2026-90497 · Other software · Fengoffice · reported by VulDBLow 2
A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/add_task.php of the component Task Title Output. Executing a manipulation of the argument og_objects.name can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Feng Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Sep 12, 2026A vulnerability was determined in Xuxueli xxl-job up to 3.4.2.CVE-2026-90488 · Other software · Xuxueli · reported by VulDBLow 2.1
A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2026BEAR: Does not verify a CSRF nonce or check user capabilities before updating taxonomy termsCVE-2026-84023 · WordPress plugins & themes · reported by WPScanMedium 6.5
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page.
- Product
- BEAR
- Fixed in
- 1.2.2
- What to do
- Update BEAR to 1.2.2 or newer.
Sep 11, 2026In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aa_vec_unique() null tCVE-2026-89761 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aa_vec_unique() null terminates at vec[n - dups] when VEC_FLAG_TERMINATE is passed. If the components are all distinct no duplicates are dropped, dups is 0 and the terminator goes to vec[n], so the caller has to provide room for n + 1 entries. aa_label_strn_parse() sets up its vector with vec_setup(profile, vec, len, gfp) and then calls aa_vec_unique(vec, len, VEC_FLAG_TERMINATE), but vec_setup() does not reserve the terminator entry. Up to LOCAL_VEC_ENTRIES it uses the local array of LOCAL_VEC_ENTRIES pointers, above that it allocates exactly len pointers. The terminator therefore lands one entry past the end of the local array when len is LOCAL_VEC_ENTRIES, and one entry past the end of the allocation when len is larger. len comes from the number of "//&" separated components in the label name and label_count_strn_entries() does not bound it. An unprivileged task reaches the parse by writing to /proc/self/attr/apparmor/current or through lsm_set_self_attr(2), both of which go through do_setattr(), and the name is parsed before the change_prof
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 11, 2026In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in build_constructor_string() Reserve space forCVE-2026-89575 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in build_constructor_string() Reserve space for the termination NUL after the maximum 20 decimal digits of a long long value to avoid buffer overflow in sprintf().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 11, 2026In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: terminate the strings from firmware The qcom_battmgr_sc8280xpCVE-2026-89466 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.7
In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: terminate the strings from firmware The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and leaves the destination without a terminator. Those destinations are model_number, serial_number and oem_info, each BATTMGR_STRING_LEN and declared next to each other. They go out to user space as val->strval, which power_supply_format_property() prints with "%s", so a firmware string that fills the whole field makes that read run into the following members. Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 11, 2026The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt passwCVE-2026-38058 · Other software · ST Engineering iDirect · reported by ics-cert@hq.dhs.govHigh 8.6
The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.
- Product
- Evolution iQ‑Series terminals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.idirect.net
Sep 11, 2026A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0.CVE-2026-38056 · Other software · ST Engineering iDirect · reported by ics-cert@hq.dhs.govCritical 9.4
A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs, vessels, and remote sites. Important context: the device ships from the factory with a pre-configured low-privilege local user account. This account is intended for field technicians who need shell access for maintenance and diagnostics but should not have full administrative control over the device. This built-in account provides the initial access required to exploit this vulnerability. No additional credentials need to be obtained or brute-forced.
- Product
- Evolution iQ‑Series terminals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.idirect.net
Sep 8, 2026The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments.CVE-2026-78635 · Other software · Okta · reported by psirt@okta.comMedium 5
The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.
- Product
- Okta Privileged Access Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A vulnerability was determined in Cesanta mJS up to 1.26.CVE-2026-86716 · Other software · Cesanta · reported by VulDBMedium 5.5
A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skip_spaces_and_comments of the file src/mjs_tok.c. Executing a manipulation can lead to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf.CVE-2026-86673 · Other software · ningzichun · reported by VulDBMedium 5.5
A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqli_connect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Student Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper null termination in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2026-78506 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper null termination in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper null termination in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.CVE-2026-70587 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper null termination in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Unintended proxy or intermediary ('confused deputy') in Microsoft Windows Speech allows an authorized attacker to perform tampering locally.CVE-2026-69531 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Unintended proxy or intermediary ('confused deputy') in Microsoft Windows Speech allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A vulnerability was determined in star7th showdoc up to 3.9.1.CVE-2026-86644 · Other software · star7th · reported by VulDBLow 2
A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web_src/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 is able to resolve this issue. This patch is called a8ea1520850b4242f395247f72e87e597506cef0. Upgrading the affected component is recommended. The vendor confirms: "The fix [...] sets Mermaid `securityLevel` to `strict`, disables `htmlLabels`, and sanitizes rendered SVG with DOMPurify."
- Product
- showdoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 8, 2026When guests are terminated, various pieces of cleanup need carrying out.CVE-2026-62437 · Other software · Xen · reported by security@xen.orgMedium 6.5
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
- Product
- Xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxenbits.xenproject.orgopenwall.com
Sep 8, 2026A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundCVE-2026-19203 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.3
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.
- Product
- Eclipse Jetty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation.CVE-2026-86711 · Other software · electerm · reported by VulnCheckHigh 7.5
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal cCVE-2026-82710 · Other software · ash-project · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbLow 2.3
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage_rules.search_docs. mix usage_rules.search_docs searches Hex documentation through search.hexdocs.pm, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in Mix.Tasks.UsageRules.SearchDocs interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged — forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package. This issue affects usage_rules: from 0.
- Product
- usage_rules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Sep 7, 2026In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.logCVE-2026-86501 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.8
In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f.CVE-2026-86303 · Other software · 92181 · reported by VulDBMedium 6.9
A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This patch is called c000d2f9cf390c315378d3717cf20911cf3e80a6. A patch should be applied to remediate this issue.
- Product
- markdown
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026A vulnerability was determined in D-Link DIR-822A A_101.CVE-2026-86296 · Network & remote access · D-Link · reported by VulDBCritical 9.3
A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DIR-822A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtzh00203.notion.sitevuldb.com
Sep 7, 2026A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-ELCVE-2026-79697 · Other software · Advantech · reported by VulDBHigh 8.6
A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects the function basicstation_apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4_20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- WISE-6610-NB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorduvxbywu62qm.feishu.cnvuldb.com
Sep 7, 2026A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000.CVE-2026-86272 · Other software · Beijing Meite Software Technology · reported by VulDBMedium 5.5
A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000. This impacts an unknown function of the file /Report/Upload/UploadFormImg.ashx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- U+Smart Enjoyment WebSite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorducn9h68n9289.feishu.cnvuldb.com
Sep 6, 2026A vulnerability was determined in Mstfakts College-Management-System.CVE-2026-86214 · Other software · reported by VulDBMedium 5.5
A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown function of the file Front-end/login.php. This manipulation of the argument email causes improper authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2026A vulnerability was determined in diem-project diem up to 5.1.3.CVE-2026-86182 · Other software · diem-project · reported by VulDBLow 2.1
A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dm_command causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- diem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2026A vulnerability was determined in Tenda HG10 300001138.CVE-2026-86166 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- HG10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026In the Linux kernel, the following vulnerability has been resolved: dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA When terminating DMA tCVE-2026-80902 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA When terminating DMA transfers, active descriptors are not properly reclaimed. Only cyclic descriptors were handled, leaving non-cyclic descriptors and their LLI chains to be permanently leaked. Fix by using vchan_terminate_vdesc() which handles both cyclic and non-cyclic descriptors by adding them to desc_terminated queue for proper cleanup. Add pchan->desc != pchan->done check to prevent double-adding completed descriptors, which would corrupt the list.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 4, 2026A vulnerability was determined in Eleveo Quality Management 9.7.0.CVE-2026-85408 · Other software · Eleveo · reported by VulDBLow 2.1
A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations/<ID>/events of the component Conversation Handler. This manipulation of the argument createdBy causes dynamically-determined object attributes. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Quality Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram() that writes a NUL terminator one byte past the serial tCVE-2026-85454 · Other software · themoos · reported by VulnCheckMedium 5.2
MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram() that writes a NUL terminator one byte past the serial telegram stack buffer. Attackers controlling the serial line can send a full-length telegram to trigger the off-by-one write, corrupting the stack and potentially enabling code execution.
- Product
- core-moos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicaCVE-2026-85451 · Other software · themoos · reported by VulnCheckHigh 7.1
MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process shutdown by exploiting the default multicast group and port with the known passphrase.
- Product
- core-moos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01.CVE-2026-85224 · Network & remote access · D-Link · reported by VulDBHigh 8.5
A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file_sharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DNS-320 ShareCenter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the pCVE-2026-84971 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.1
Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running.
- Product
- libmongocrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.