Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
399,281 results · page 705 of 7986
Sep 10, 2026Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for Integrity Check vulnerability.CVE-2026-81049 · Other software · Dell · reported by security_alert@emc.comMedium 4.4
Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution.
- Product
- ThinOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability.CVE-2026-81048 · Other software · Dell · reported by security_alert@emc.comCritical 9.6
Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote Code execution
- Product
- ThinOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability.CVE-2026-81046 · Other software · Dell · reported by security_alert@emc.comCritical 9.4
Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Arbitrary Code Execution within the application context.
- Product
- ThinOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.CVE-2026-79987 · Other software · craftcms · reported by 7004884b-51e2-48e8-b4a2-5ca29e80453eHigh 8.7
A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026There is a storage of sensitive information in cleartext vulnerability in NI SystemLink.CVE-2026-4130 · Other software · NI · reported by security@ni.comHigh 8.4
There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear. This vulnerability affects NI SystemLink and NI SystemLink Server versions prior to 2026 Q3.
- Product
- SystemLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system CVE-2026-4129 · Other software · NI · reported by security@ni.comHigh 8.6
There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server versions prior to 2026 Q3.
- Product
- SystemLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026A flaw was found in the admin backend of gvfs.CVE-2026-88924 · Other software · GNOME · reported by Red HatHigh 7
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.
- Product
- gvfs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 10, 2026AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to CVE-2026-88898 · Other software · AppFlowy-IO · reported by VulnCheckHigh 7.1
AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata into victim workspaces to deface public pages or host phishing content on trusted URLs.
- Product
- AppFlowy-Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 10, 2026Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes.CVE-2026-88897 · Other software · flextype · reported by VulnCheckHigh 8.2
Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.
- Product
- flextype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Traefik is an open source HTTP reverse proxy and load balancer.CVE-2026-88008 · Other software · traefik · reported by GitHubHigh 7
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching Protocols, Traefik enters a raw tunnel and no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to later HTTP/2 requests, allowing an unauthenticated request through an unprotected route to reach protected paths on the same backend. This issue is fixed in 2.11.57 and 3.7.13.
- Product
- traefik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Traefik is an open source HTTP reverse proxy and load balancer.CVE-2026-88007 · Other software · traefik · reported by GitHubCritical 9.1
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.
- Product
- traefik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.CVE-2026-88006 · Other software · open-webui · reported by GitHubMedium 6.5
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at their existing role through this endpoint. This issue is fixed in version 0.11.1.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.CVE-2026-88005 · Other software · open-webui · reported by GitHubMedium 6.5
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through this endpoint. This issue is fixed in version 0.9.0.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Traefik is an open source HTTP reverse proxy and load balancer.CVE-2026-88004 · Other software · traefik · reported by GitHubHigh 7
Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted header name in an HTTP/1.1 chunked trailer or an HTTP/2 trailer. When the retry or buffering middleware reads the body before the reverse proxy clones the request, the attacker-controlled trailer value reaches a backend that merges trailers into the header namespace, bypassing the documented delete or reject behavior and potentially spoofing identity or forwarded routing data. This issue is fixed in 3.7.13.
- Product
- traefik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.CVE-2026-85310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.CVE-2026-84821 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.
- Affected
- up to 1.82.284
- What to do
- Affects up to 1.82.284. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.CVE-2026-84819 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.CVE-2026-84816 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions.CVE-2026-81805 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions.CVE-2026-81804 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions.
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.CVE-2026-81803 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.
- Affected
- up to 4.1224
- What to do
- Affects up to 4.1224. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Settings Change in WP-Stateless <= 4.4.1 versions.CVE-2026-81801 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Subscriber Settings Change in WP-Stateless <= 4.4.1 versions.
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.CVE-2026-81800 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Return Refund and Exchange For WooCommerce: Missing AuthorizationCVE-2026-81799 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WP Swings Return Refund and Exchange For WooCommerce woo-refund-and-exchange-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Return Refund and Exchange For WooCommerce: from n/a through 4.6.4.
- Product
- Return Refund and Exchange For WooCommerce
- Affected
- up to 4.6.4
- What to do
- Affects up to 4.6.4. Update Return Refund and Exchange For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026WP Travel: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-81796 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3.
- Product
- WP Travel
- Affected
- up to 12.0.3
- What to do
- Affects up to 12.0.3. Update WP Travel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions.CVE-2026-81795 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions.
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.CVE-2026-81794 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.
- What to do
- Update the plugin to the newest version.
Sep 10, 2026Salon booking system: Missing AuthorizationCVE-2026-81793 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9.
- Product
- Salon booking system
- Affected
- up to 10.31.9
- What to do
- Affects up to 10.31.9. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.CVE-2026-81791 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.
- Affected
- up to 2.5.7
- What to do
- Affects up to 2.5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Advanced Product Fields Extended for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-81789 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6.
- Product
- Advanced Product Fields Extended for WooCommerce
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update Advanced Product Fields Extended for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.CVE-2026-81788 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.CVE-2026-81787 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions.CVE-2026-81786 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.CVE-2026-81785 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Wise Chat: Deserialization of Untrusted DataCVE-2026-81784 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2.
- Product
- Wise Chat
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update Wise Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.CVE-2026-81783 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions.CVE-2026-81782 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions.
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.CVE-2026-81275 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.CVE-2026-78536 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.CVE-2026-66674 · WordPress plugins & themes · reported by PatchstackMedium 5.6
Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.
- Affected
- up to 1.42.1
- What to do
- Affects up to 1.42.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.CVE-2026-66632 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.
- Affected
- up to 1.42.1
- What to do
- Affects up to 1.42.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-46387 · Other software · OISF · reported by GitHubHigh 7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA payload using a high compression ratio, such as gzip, deflate, or brotli compressed data, could cause Suricata to allocate excessive memory while decompressing the payload. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable HTTP2.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.suricata.iogithub.com
Sep 10, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-45747 · Other software · OISF · reported by GitHubHigh 7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic where some certificate fields were absent. Crafted TLS traffic processed by a deployment using affected Lua TLS scripting could crash Suricata, resulting in denial of service. Version 7.0.16 contains a fix. As a workaround, avoid Lua scripts that call TLS certificate information helpers on untrusted traffic (`TlsGetCertInfo` function), or update scripts to handle missing certificate fields where possible.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.suricata.iogithub.com
Sep 10, 2026The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl78xx/) embeds a generic struct gnss_nmea0183_match_CVE-2026-15461 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgMedium 5.3
The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl78xx/) embeds a generic struct gnss_nmea0183_match_data match_data inside struct hl78xx_gnss_data. The generic NMEA0183 match helper (drivers/gnss/gnss_nmea0183_match.c) requires that context to be the first member because its callbacks cast user_data directly to struct gnss_nmea0183_match_data . In the affected releases match_data was the second member (after const struct device dev), so it sat at a non-zero offset while gnss_nmea0183_match_init() initialized it at the correct address. The registered NMEA handlers instead pass the whole device data object (data->devices.gnss->data, offset 0), producing an offset-shifted type confusion between where state is initialized and where the parse callbacks read and write it. When NMEA sentences from the GNSS receiver are parsed, the GGA/RMC callbacks write parsed fix data into the wrong location within the struct, and the GSV callback (gnss_nmea0183_match_gsv_callback, active under CONFIG_GNSS_SATELLITES) reads its satellites pointer and bound from the wrong offsets — non-pointer bytes of struct hl78xx_gnss_data — and then writes
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references (attribuCVE-2026-88921 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 5.1
MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references (attributes, objects, and tags) into inline HTML during PDF report export via the convert_markdown_to_pdf module. The attribute(), objectAttribute(), object(), and tag() methods interpolated user-controlled fields (attribute type, attribute value, object name, object relation, tag name, tag colour, and tag text colour) directly into HTML templates without applying HTML entity encoding. An authenticated user with the ability to create or modify MISP attributes, objects, or tags could embed arbitrary HTML markup in these fields. When a report containing such elements was exported to PDF, the unescaped content was rendered as live HTML rather than inert text, potentially injecting script tags, breaking the document structure, or altering the visual content of the exported report. Additionally, the attribute() method contained a template with hardcoded sample values ("domain-ip" and "google.com") instead of format placeholders, meaning every plain attribute reference in a PDF displayed the sample text rather than the actual indicator va
- Product
- MISP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates.CVE-2026-88915 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 7.1
Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the template can specify a sharing_group_id. The instantiation path passed that value into event creation without verifying that the user instantiating the template was actually permitted to use the selected sharing group. The commit notes that Event::_add() only performed its own sharing-group authorization in another code path, leaving template instantiation able to write the identifier directly. The same instantiation path also attached template-specified tags without checking the user's normal tagging permissions. In addition, it hardcoded local => 0, meaning tags marked local_only could be attached globally and consequently propagate through synchronization or export, contrary to their intended restriction. The fix adds explicit SharingGroup::canUse() authorization for the acting user, applies the same tag-modification checks used by normal event tagging, and ensures local_only tags are attached locally. Version affected: ≤2.5.45
- Product
- MISP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026EspoCRM before 10.0.4 is vulnerable to server-side request forgery.CVE-2026-88896 · Other software · espocrm · reported by VulnCheckMedium 6.9
EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: (IPv4-mapped IPv6) prefixes but does not recognize IPv6 transition addresses that embed private IPv4 addresses: NAT64 (64:ff9b::), 6to4 (2002::), and Teredo (2001:0000::). An attacker who controls a domain with AAAA records pointing to such transition addresses can bypass both the internal-host validation and the CURLOPT_RESOLVE IP-pinning check, causing EspoCRM to issue outbound requests to internal network services. Affected paths include POST /Attachment/fromImageUrl, reachable by any authenticated user with attachment access, and outbound webhook delivery, which requires an admin or API user.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 10, 2026CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokenCVE-2026-88895 · Other software · usmannasir · reported by VulnCheckHigh 8.6
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
- Product
- cyberpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 10, 2026Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target.CVE-2026-88894 · Other software · grokability · reported by VulnCheckMedium 5.3
Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and an availability check before persisting the checkout. With FMCS enabled, a non-superuser who belongs to at least two companies and holds the assets.checkout permission can POST to /kits/{kit}/checkout with a user_id belonging only to company B and have a company-A asset (and likewise kit licenses, consumables and accessories) assigned to that user, bypassing the company-mismatch check that blocks the same operation on every other checkout path. The issue is fixed in Snipe-IT 8.7.2; it was runtime-verified on v8.6.3 and code-inspected on v8.7.1, and the affected service has lacked the check since 2019, so earlier FMCS deployments are likely also affected.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 10, 2026OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated CVE-2026-88893 · Other software · Openpanel-dev · reported by VulnCheckHigh 8.7
OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft.
- Product
- openpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.