Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,966 results · page 7 of 80
Sep 8, 2026Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.CVE-2026-80086 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.CVE-2026-80081 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.CVE-2026-78513 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally.CVE-2026-77897 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally.
- Product
- Power Automate agent for virtual desktops
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.CVE-2026-72977 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.CVE-2026-72975 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.CVE-2026-72956 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a netwCVE-2026-72938 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an authorized attacker to elevate privileges over a CVE-2026-69807 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an authorized attacker to elevate privileges over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.CVE-2026-69797 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.CVE-2026-69767 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.CVE-2026-69678 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Heap-based buffer overflow in Windows Power Dependency Coordinator allows an authorized attacker to elevate privileges locally.CVE-2026-69459 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Power Dependency Coordinator allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally.CVE-2026-69321 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security featurCVE-2026-62801 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Powerkit: Stored Cross-Site ScriptingCVE-2026-2390 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content_process_images' function using a flawed regex-based HTML attribute parser. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Powerkit
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Powerkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 6, 2026In Power HAL, there is a possible out of bounds write due to a missing bounds check.CVE-2026-20509 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11165543; Issue ID: MSV-9011.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2026In Power HAL, there is a possible escalation of privilege due to type confusion.CVE-2026-20508 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In Power HAL, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11165543; Issue ID: MSV-9012.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport poCVE-2026-75430 · Other software · reported by MITRECritical 9.8
PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 4, 2026PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication.CVE-2026-75431 · Other software · reported by MITRECritical 9.1
PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 4, 2026PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transporCVE-2026-75429 · Other software · reported by MITRECritical 9.8
PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 4, 2026Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote aCVE-2026-44402 · Other software · Voltronic Power · reported by VulnCheckCritical 9.3
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and executed as root, achieving full system compromise.
- Product
- SNMP Web Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvoltronicpower.com
Sep 4, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadataCVE-2026-84066 · WordPress plugins & themes · reported by WPScanLow 3.1
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Fixed in
- 8.9
- What to do
- Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9 or newer.
Sep 3, 2026Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.CVE-2026-65818 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.5
Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Power Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Colord is a tiny yet powerful tool for high-performance color manipulations and conversions.CVE-2026-85062 · Other software · omgovich · reported by GitHubMedium 6.9
Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\d*.?\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.
- Product
- colord
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API.CVE-2026-74769 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API.CVE-2026-74768 · Other software · Dell · reported by security_alert@emc.comMedium 4.1
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent.CVE-2026-73600 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability.CVE-2026-68860 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to Launch of phishing attacks.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Vitest is a testing framework powered by Vite.CVE-2026-84373 · Other software · vitest-dev · reported by GitHubMedium 5.9
Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.
- Product
- vitest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-sCVE-2026-19591 · Other software · OpenAI · reported by 8f4f43ab-ba69-4d92-aa1d-d772184d6fb7High 8.8
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token (--%) differently than PowerShell itself. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting user approval. On macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex's configuration. If Codex later loads the modified configuration, it can launch an attacker-controlled MCP server and execute code with the user's privileges, allowing it to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing; the default filesystem sandbox on macOS and Linux can prevent writes outside permitted locations.
- Product
- Codex CLI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Dell PowerStore, an Incorrect Authorization vulnerability.CVE-2026-58566 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- PowerStore 500T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability.CVE-2026-79687 · Other software · Dell · reported by security_alert@emc.comCritical 9
Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access.
- Product
- PowerStore 500T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Dell PowerStore contains a Command Injection vulnerability.CVE-2026-79682 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
- Product
- PowerStore 500T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Dell PowerStore contains an OS Command Injection vulnerability.CVE-2026-58567 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
- Product
- PowerStore 500T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Dell PowerStore contains a Protection Mechanism Failure vulnerability.CVE-2026-79686 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges.
- Product
- PowerStore 500T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Dell PowerStore contains an Argument Injection vulnerability.CVE-2026-79685 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell PowerStore contains an Argument Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to gain unauthorized access to sensitive sensitive system information.
- Product
- PowerStore 500T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability.CVE-2026-58569 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges..
- Product
- PowerStore 500T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Dell PowerStore contains a Protection Mechanism Failure vulnerability.CVE-2026-79684 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges.
- Product
- PowerStore 500T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Dell PowerStore contains a Code Injection vulnerability.CVE-2026-58572 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges.
- Product
- PowerStore 500T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Dell PowerStore contains an OS Command Injection vulnerability.CVE-2026-58571 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
- Product
- PowerStore 500T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user accouCVE-2026-13348 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 6.9
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user account by performing an arbitrary number of authentication attempts when redirect handling is disabled.
- Product
- PowerChute™ Serial Shutdown
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Dell PowerStore contains a Protection Mechanism Failure vulnerability.CVE-2026-79683 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write attacker-controlled content to arbitrary filesystem paths.
- Product
- PowerStore 500T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability.CVE-2026-58575 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially exploit this vulnerability to escalate privileges to Administrator.
- Product
- PowerStore 500T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Dell PowerStore contains an Incorrect Authorization vulnerability.CVE-2026-76111 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could potentially exploit this vulnerability to invoke administrator-only operations, leading to privilege escalation.
- Product
- PowerStore 500T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Listdom: AI-powered Business Directory with Classifieds Ads Listings: Stored Cross-Site ScriptingCVE-2026-19796 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' displ setting to be enabled, both of which are non-default configurations.
- Product
- Listdom: AI-powered Business Directory with Classifieds Ads Listings
- Affected
- up to 5.8.1
- What to do
- Affects up to 5.8.1. Update Listdom: AI-powered Business Directory with Classifieds Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 31, 2026Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reduce wireless power or causCVE-2026-51688 · Other software · reported by MITREHigh 7.5
Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reduce wireless power or cause a Denial of Service (DoS) via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A vulnerability was identified in PowerJob up to 5.1.2.CVE-2026-82630 · Other software · reported by VulDBMedium 5.5
A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the component Transport Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Dell PowerStore contains a Missing Authentication for Critical Function vulnerability.CVE-2026-58574 · Other software · Dell · reported by security_alert@emc.comCritical 9.8
Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface could potentially exploit this vulnerability to read internal system information from the appliance filesystem. This is a Critical vulnerability as it could expose sensitive information and credentials which allow full administrative access to the array.
- Product
- PowerStore 500T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2026HEL Online Classroom: AI-powered Online Classrooms: Does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access codeCVE-2026-77010 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.
- Product
- HEL Online Classroom: AI-powered Online Classrooms
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update HEL Online Classroom: AI-powered Online Classrooms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.