Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,298 results · page 73 of 346
Apr 10, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-35597 · Other software · go-vikunja · reported by GitHubMedium 5.9
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. When a TOTP validation fails, the login handler in pkg/routes/api/v1/login.go calls HandleFailedTOTPAuth and then unconditionally rolls back. HandleFailedTOTPAuth in pkg/user/totp.go uses an in-memory counter (key-value store) to track failed attempts. When the counter reaches 10, it calls user.SetStatus(s, StatusAccountLocked) on the same database session s. Because the login handler always rolls back after a TOTP failure, the StatusAccountLocked write is undone. The in-memory counter correctly increments past 10, so the lockout code executes on every subsequent attempt, but the database write is rolled back every time. This allows unlimited brute-force attempts against TOTP codes. This vulnerability is fixed in 2.3.0.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-35596 · Other software · go-vikunja · reported by GitHubMedium 4.3
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, descriptions, colors, and creator information are exposed. This vulnerability is fixed in 2.3.0.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-35595 · Other software · go-vikunja · reported by GitHubHigh 8.3
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only requires CanWrite on the new parent project when changing parent_project_id. However, Vikunja's permission model uses a recursive CTE that walks up the project hierarchy to compute permissions. Moving a project under a different parent changes the permission inheritance chain. When a user has inherited Write access (from a parent project share) and reparents the child project under their own project tree, the CTE resolves their ownership of the new parent as Admin (permission level 2) on the moved project. This vulnerability is fixed in 2.3.0.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-35594 · Other software · go-vikunja · reported by GitHubMedium 6.5
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or downgrades its permissions, all previously issued JWTs continue to grant the original permission level for up to 72 hours (the default service.jwtttl). This vulnerability is fixed in 2.3.0.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-34727 · Other software · go-vikunja · reported by GitHubHigh 7.4
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Dockyard is a Docker container management app.CVE-2026-39848 · Other software · 10ij · reported by GitHubMedium 6.5
Dockyard is a Docker container management app. Prior to 1.1.0, Docker container start and stop operations are performed through GET requests without CSRF protection. A remote attacker can cause a logged-in administrator's browser to request /apps/action.php?action=stop&name=<container> or /apps/action.php?action=start&name=<container>, which starts or stops the target container. This vulnerability is fixed in 1.1.0.
- Product
- dockyard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS onCVE-2026-33775 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7.1
A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). If the authentication packet-type option is configured and a received packet does not match that packet type, the memory leak occurs. When all memory available to bbe-smgd has been consumed, no new subscribers will be able to login. The memory utilization of bbe-smgd can be monitored with the following show command: user@host> show system processes extensive | match bbe-smgd The below log message can be observed when this limit has been reached: bbesmgd[<PID>]: %DAEMON-3-SMD_DPROF_RSMON_ERROR: Resource unavailability, Reason: Daemon Heap Memory exhaustion This issue affects Junos OS on MX Series: * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S5, * 23.4 versions before 23.4R2-S6, * 24.2 versions before 24.2R2-S2, * 24.4 versions before 24.4R2, * 25.2 versions before 25.2R2.
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026A Weak Password Requirements vulnerability in the password management function of Juniper Networks CTP OS might allow an unauthenticated, network-based attackerCVE-2026-33771 · Network & remote access · Juniper Networks · reported by sirt@juniper.netCritical 9.1
A Weak Password Requirements vulnerability in the password management function of Juniper Networks CTP OS might allow an unauthenticated, network-based attacker to exploit weak passwords of local accounts and potentially take full control of the device. The password management menu enables the administrator to set password complexity requirements, but these settings are not saved. The issue can be verified with the menu option "Show password requirements". Failure to enforce the intended requirements can lead to weak passwords being used, which significantly increases the likelihood that an attacker can guess these and subsequently attain unauthorized access. This issue affects CTP OS versions 9.2R1 and 9.2R2.
- Product
- CTP OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026An Incorrect Synchronization vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker withCVE-2026-21919 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7.1
An Incorrect Synchronization vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker with low privileges to cause a complete Denial-of-Service (DoS) of the management plane. When NETCONF sessions are quickly established and disconnected, a locking issue causes mgd processes to hang in an unusable state. When the maximum number of mgd processes has been reached, no new logins are possible. This leads to the inability to manage the device and requires a power-cycle to recover. This issue can be monitored by checking for mgd processes in lockf state in the output of 'show system processes extensive': user@host> show system processes extensive | match mgd <pid> root 20 0 501M 4640K lockf 1 0:01 0.00% mgd If the system still can be accessed (either via the CLI or as root, which might still be possible as last resort as this won't invoke mgd), mgd processes in this state can be killed with 'request system process terminate <PID>' from the CLI or with 'kill -9 <PID>' from the shell. This issue affects: Junos OS: * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2-S1,
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026SiYuan is a personal knowledge management system.CVE-2026-40107 · Other software · siyuan-note · reported by GitHubHigh 8.7
SiYuan is a personal knowledge management system. Prior to 3.6.4, SiYuan configures Mermaid.js with securityLevel: "loose" and htmlLabels: true. In this mode, <img> tags with src attributes survive Mermaid's internal DOMPurify and land in SVG <foreignObject> blocks. The SVG is injected via innerHTML with no secondary sanitization. When a victim opens a note containing a malicious Mermaid diagram, the Electron client fetches the URL. On Windows, a protocol-relative URL (//attacker.com/image.png) resolves as a UNC path (\\attacker.com\image.png). Windows attempts SMB authentication automatically, sending the victim's NTLMv2 hash to the attacker. This vulnerability is fixed in 3.6.4.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.CVE-2026-39985 · Other software · aces · reported by GitHubMedium 4.3
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS, which could be used to trick users into visiting arbitrary URLs if they are given a link with a third party redirect parameter. This vulnerability is fixed in 27.0.3 and 28.0.1.
- Product
- Loris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Lychee is a free, open-source photo-management tool.CVE-2026-39957 · Other software · LycheeOrg · reported by GitHubLow 2.3
Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL operator-precedence bug in SharingController::listAll() causes the orWhereNotNull('user_group_id') clause to escape the ownership filter applied by the when() block. Any authenticated non-admin user with upload permission who owns at least one album can retrieve all user-group-based sharing permissions across the entire instance, including private albums owned by other users. This vulnerability is fixed in 7.5.4.
- Product
- Lychee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026ChurchCRM is an open-source church management system.CVE-2026-39941 · Other software · ChurchCRM · reported by GitHubMedium 5.3
ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output encoding, enabling arbitrary JavaScript execution in victims' browsers. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Plane is an an open-source project management tool.CVE-2026-39843 · Other software · makeplane · reported by GitHubHigh 7.7
Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the same full read Server-Side Request Forgery when a normal html page contains a link tag with an href that redirects to a private IP address is supplied to Add link by an authenticated attacker with low privileges. Redirects for the main page URL are validated, but not the favicon fetch path. fetch_and_encode_favicon() still uses requests.get(favicon_url, ...) with the default redirect-following. This vulnerability is fixed in 1.3.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management fCVE-2025-70811 · Websites & servers · Phpbb · reported by MITREMedium 4.3
Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management functionality.
- Product
- Phpbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC.CVE-2024-1490 · Other software · WAGO · reported by info@cert.vde.comHigh 7.2
An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the attacker to run arbitrary commands on the device.
- Product
- CC100 (0751-9x01)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comwago.csaf-tp.certvde.com
Apr 8, 2026A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creationCVE-2026-3199 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11Critical 9.4
A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.
- Product
- Nexus Repository
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
Apr 8, 2026Frappe Learning Management System (LMS) is a learning system that helps users structure their content.CVE-2026-39415 · Other software · frappe · reported by GitHubMedium 5.3
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.46.0, a vulnerability has been identified in Frappe Learning where quiz scores can be modified by students before submission. The application currently relies on client-side calculated scores, which can be altered using browser developer tools prior to sending the submission request. While this does not allow modification of other users’ data or privilege escalation, it compromises the integrity of quiz results and undermines academic reliability. This issue affects data integrity but does not expose confidential information or allow unauthorized access to other accounts. This vulnerability is fixed in 2.46.0.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Remnawave Backend is the backend for the Remnawave proxy and user management solution.CVE-2026-39880 · Other software · remnawave · reported by GitHubMedium 5
Remnawave Backend is the backend for the Remnawave proxy and user management solution. Prior to 2.7.5, a glitch in the HWID device registration logic allows an authenticated user to bypass the configured limit for HWID devices and register more devices than expected, allowing them to resell subscriptions and consume excessive traffic. This vulnerability is fixed in 2.7.5.
- Product
- backend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-39362 · Other software · inventree · reported by GitHubMedium 5.3
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, when INVENTREE_DOWNLOAD_FROM_URL is enabled (opt-in), authenticated users can supply remote_image URLs that are fetched server-side via requests.get() with only Django's URLValidator check. There is no validation against private IP ranges or internal hostnames. Redirects are followed (allow_redirects=True), enabling bypass of any URL-format checks. This vulnerability is fixed in 1.2.7 and 1.3.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-35479 · Other software · inventree · reported by GitHubMedium 6.6
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring "superuser" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentially harmful) plugins. This vulnerability is fixed in 1.2.7 and 1.3.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.inventree.orgdocs.inventree.org
Apr 8, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-35478 · Other software · inventree · reported by GitHubHigh 8.3
InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST /api/user/tokens/ request. The returned token is immediately usable for full API authentication as the target user, from any network location, with no further interaction required. This vulnerability is fixed in 1.2.7 and 1.3.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-35477 · Other software · inventree · reported by GitHubMedium 5.5
InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed jinja2.Environment. Additionally, the validator uses a dummy Part instance with pk=None, which allows conditional template expressions to behave differently during validation versus production rendering. A staff user with settings access can craft a template that passes validation but executes arbitrary code during rendering. This issue requires access by a user with granted staff permissions. This vulnerability is fixed in 1.2.7 and 1.3.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026InvenTree is an Open Source Inventory Management System.CVE-2026-35476 · Other software · inventree · reported by GitHubHigh 7.2
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.
- Product
- InvenTree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.inventree.orggithub.com
Apr 8, 2026immich is a high performance self-hosted photo and video management solution.CVE-2026-35455 · Other software · immich-app · reported by GitHubHigh 7.3
immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360° panorama viewer allows any authenticated user to execute arbitrary JavaScript in the browser of any other user who views the malicious panorama with the OCR overlay enabled. The attacker uploads an equirectangular image containing crafted text; OCR extracts it, and the panorama viewer renders it via innerHTML without sanitization. This enables session hijacking (via persistent API key creation), private photo exfiltration, and access to GPS location history and face biometric data. This vulnerability is fixed in 2.7.0.
- Product
- immich
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.CVE-2026-35446 · Other software · aces · reported by GitHubHigh 7.7
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 24.0.0 to before 27.0.3 and 28.0.1, an incorrect order of operations in the FilesDownloadHandler could result in an attacker escaping the intended download directories. This vulnerability is fixed in 27.0.3 and 28.0.1.
- Product
- Loris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.CVE-2026-35403 · Other software · aces · reported by GitHubMedium 6.5
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 15.10 to before 27.0.3 and 28.0.1, there is a potential for a cross-site scripting attack in the survey_accounts module if a user provides an invalid visit label. While the data is properly JSON encoded, the Content-Type header is not set causing the web browser to interpret the payload as HTML, opening the possibility of a cross-site scripting if a user is tricked into following an invalid link. This vulnerability is fixed in 27.0.3 and 28.0.1.
- Product
- Loris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.CVE-2026-35400 · Other software · aces · reported by GitHubLow 3.5
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, an endpoint in the publication module was incorrectly trusting the baseURL submitted by a user's POST request rather than the internal LORIS value. This could result in a theoretical attacker with publication module access forging an email to an external domain under the attacker's control which appeared to come from LORIS. This vulnerability is fixed in 27.0.3 and 28.0.1.
- Product
- Loris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.CVE-2026-35169 · Other software · aces · reported by GitHubHigh 8.7
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From to before 27.0.3 and 28.0.1, the help_editor module of LORIS did not properly sanitize some user supplied variables which could result in a reflected cross-site scripting attack if a user is tricked into following an invalid link. The same input vector could also allow an attacker to download arbitrary markdown files on an unpatched server. This vulnerability is fixed in 27.0.3 and 28.0.1.
- Product
- Loris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.CVE-2026-35165 · Other software · aces · reported by GitHubMedium 6.3
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 21.0.0 to before 27.0.3 and 28.0.1, while the document_repository frontend was restricting file access, the backend endpoint was not correctly verifying access permissions. A user could theoretically download a file that they should not have access to, if they know or can brute force the filename. This vulnerability is fixed in 27.0.3 and 28.0.1.
- Product
- Loris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.CVE-2026-34985 · Other software · aces · reported by GitHubMedium 6.3
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 16.1.0 to before 27.0.3 and 28.0.1, While the frontend of the media module filters files that the user should not have access to, the backend was not applying access checks and it would be possible for someone who should not have access to a file to access it if they know the filename. This vulnerability is fixed in 27.0.3 and 28.0.1.
- Product
- Loris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.CVE-2026-34392 · Other software · aces · reported by GitHubHigh 7.5
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router can allow an attacker to traverse outside of the intended directory, allowing unintended files to be downloaded through the static, css, and js endpoints. This vulnerability is fixed in 27.0.3 and 28.0.1.
- Product
- Loris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.CVE-2026-33350 · Other software · aces · reported by GitHubHigh 7.5
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, a SQL injection has been identified in some code sections for the MRI feedback popup window of the imaging browser. Attackers can use SQL ingestion to access/alter data on the server. This vulnerability is fixed in 27.0.3 and 28.0.1.
- Product
- Loris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Fleet is open source device management software.CVE-2026-27806 · Other software · fleetdm · reported by GitHubHigh 7.8
Fleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local user's password via a GUI dialog and interpolates it directly into a Tcl/expect script executed via exec.Command("expect", "-c", script). Because the password is inserted into Tcl brace-quoted send {%s}, a password containing } terminates the literal and injects arbitrary Tcl commands. Since Orbit runs as root, this allows a local unprivileged user to escalate to root privileges. This vulnerability is fixed in 4.81.1.
- Product
- fleet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026RSVP and Event Management: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-39536 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Chill RSVP and Event Management rsvp allows Retrieve Embedded Sensitive Data.This issue affects RSVP and Event Management: from n/a through <= 2.7.16.
- Product
- RSVP and Event Management
- Affected
- up to 2.7.16
- What to do
- Affects up to 2.7.16. Update RSVP and Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Sports Club Management: Stored Cross-Site ScriptingCVE-2026-4871 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sports Club Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before' and 'after' attributes of the `scm_member_data` shortcode in all versions up to, and including, 1.12.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Sports Club Management
- Affected
- up to 1.12.9
- What to do
- Affects up to 1.12.9. Update Sports Club Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 7, 2026An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly confCVE-2025-20628 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comMedium 6.9
An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. This means attackers can spoof a client-mode RCS (if one exists) to intercept and/or modify an identity’s security-relevant properties, such as passwords and account recovery information. This issue is exploitable only when an RCS is configured to run in client mode.
- Product
- PingIDM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbackstage.forgerock.combackstage.pingidentity.com
Apr 7, 2026SiYuan is a personal knowledge management system.CVE-2026-39846 · Other software · siyuan-note · reported by GitHubCritical 9
SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious note synced to another user can trigger remote code execution in the SiYuan Electron desktop client. The root cause is that table caption content is stored without safe escaping and later unescaped into rendered HTML, creating a stored XSS sink. Because the desktop renderer runs with nodeIntegration enabled and contextIsolation disabled, attacker-controlled JavaScript executes with access to Node.js APIs. In practice, an attacker can import a crafted note into a synced workspace, wait for the victim to sync, and achieve code execution when the victim opens the note. This vulnerability is fixed in 3.6.4.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-33439 · Other software · OpenIdentityPlatform · reported by GitHubCritical 9.3
Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Plane is an an open-source project management tool.CVE-2026-27949 · Other software · makeplane · reported by GitHubLow 2
Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted). Transmitting personally identifiable information (PII) via GET request query strings is classified as an insecure design practice. The affected code path is located in the authentication utility module (packages/utils/src/auth.ts). This vulnerability is fixed in 1.3.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Plane is an an open-source project management tool.CVE-2026-39374 · Other software · makeplane · reported by GitHubMedium 6.5
Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the start_date and target_date of ANY issue across the entire Plane instance, regardless of workspace or project membership. The endpoint fetches issues by ID without filtering by workspace or project, enabling cross-boundary data modification. This vulnerability is fixed in 1.3.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026OrangeHRM is a comprehensive human resource management (HRM) system.CVE-2026-39349 · Other software · orangehrm · reported by GitHubLow 2.1
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB mode, which preserves block-aligned plaintext patterns in ciphertext and enables pattern disclosure against stored data. This vulnerability is fixed in 5.8.1.
- Product
- orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026OrangeHRM is a comprehensive human resource management (HRM) system.CVE-2026-39348 · Other software · orangehrm · reported by GitHubMedium 5.3
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source omits authorization on job specification and vacancy attachment download handlers, allowing authenticated low-privilege users to read attachments via direct reference to attachment identifiers. This vulnerability is fixed in 5.8.1.
- Product
- orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026OrangeHRM is a comprehensive human resource management (HRM) system.CVE-2026-39347 · Other software · orangehrm · reported by GitHubMedium 5.1
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for administrator users after those submissions have been marked completed, breaking integrity of finalized appraisal records. This vulnerability is fixed in 5.8.1.
- Product
- orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026OrangeHRM is a comprehensive human resource management (HRM) system.CVE-2026-39346 · Other software · orangehrm · reported by GitHubMedium 5.3
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source allowed authenticated users to bypass disabled-module access controls via URL-encoded request paths and access functionality of modules disabled by an administrator. This vulnerability is fixed in 5.8.1.
- Product
- orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026OrangeHRM is a comprehensive human resource management (HRM) system.CVE-2026-39345 · Other software · orangehrm · reported by GitHubMedium 4.6
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source fails to restrict email template file resolution to the intended plugins directory, allowing an authenticated actor who can influence the template path to read arbitrary local files. This vulnerability is fixed in 5.8.1.
- Product
- orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39344 · Other software · ChurchCRM · reported by GitHubHigh 8.1
ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting (XSS) vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly displayed in the login page input element without filter, allowing attackers to insert malicious JavaScript scripts. If successful, script can be executed on the client side, potentially stealing sensitive data such as session cookies or replacing the display to show the attacker's login form. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39343 · Other software · ChurchCRM · reported by GitHubHigh 7.2
ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in the EditEventTypes.php file, which is only accessible to administrators. The EN_tyid POST parameter is not sanitized before being used in a SQL query, allowing an administrator to execute arbitrary SQL commands directly against the database. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39342 · Other software · ChurchCRM · reported by GitHubCritical 9.4
ChurchCRM is an open-source church management system. Prior to 7.1.0, the searchwhat parameter via QueryView.php with the QueryID=15 is vulnerable to a SQL injection. The authenticated user requires access to Data/Reports > Query Menu and access to the "Advanced Search" query. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39341 · Other software · ChurchCRM · reported by GitHubHigh 8.1
ChurchCRM is an open-source church management system. Prior to 7.1.0, the application is vulnerable to time-based SQL injection due to an improper input validation. Endpoint Reports/ConfirmReportEmail.php?familyId= is not correctly sanitising user input, specifically, the sanitised input is not used to create the SQL query. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.