Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,298 results · page 78 of 346
Mar 24, 2026A logic issue was addressed with improved state management.CVE-2026-28861 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 24, 2026An authorization issue was addressed with improved state management.CVE-2026-28845 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.4. An app may be able to access protected user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026A use-after-free issue was addressed with improved memory management.CVE-2026-28835 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Mounting a maliciously crafted SMB network share may lead to system termination.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 24, 2026An authorization issue was addressed with improved state management.CVE-2026-28831 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 24, 2026An authorization issue was addressed with improved state management.CVE-2026-28824 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 24, 2026An information disclosure issue was addressed with improved memory management.CVE-2026-20695 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.2
An information disclosure issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to determine kernel memory layout.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 24, 2026This issue was addressed through improved state management.CVE-2026-20693 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.9
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An attacker with root privileges may be able to delete protected system files.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 24, 2026An authorization issue was addressed with improved state management.CVE-2026-20691 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. A maliciously crafted webpage may be able to fingerprint the user.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 24, 2026A use after free issue was addressed with improved memory management.CVE-2026-20687 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.1
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, tvOS 26.4, watchOS 26.4. An app may be able to cause unexpected system termination or write kernel memory.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 24, 2026An authorization issue was addressed with improved state management.CVE-2026-20670 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 24, 2026This issue was addressed through improved state management.CVE-2026-20665 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
This issue was addressed through improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 24, 2026A use after free issue was addressed with improved memory management.CVE-2026-20637 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.2
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An app may be able to cause unexpected system termination.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 24, 2026NVIDIA Triton Inference Server Sagemaker HTTP server contains a vulnerability where an attacker may cause an exception.CVE-2025-33238 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA Triton Inference Server Sagemaker HTTP server contains a vulnerability where an attacker may cause an exception. A successful exploit of this vulnerability may lead to denial of service.
- Product
- Triton Inference Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Mar 24, 2026Keystone is a content management system for Node.js.CVE-2026-33326 · Other software · keystonejs · reported by GitHubMedium 4.3
Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany queries by passing a cursor. This can be used to confirm the existence of records by protected field values. The fix for CVE-2025-46720 (field-level isFilterable bypass for update and delete mutations) added checks to the where parameter in update and delete mutations however the cursor parameter in findMany was not patched and accepts the same UniqueWhere input type. This issue has been patched in version 6.5.2.
- Product
- keystone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Craft CMS is a content management system (CMS).CVE-2026-33162 · Other software · craftcms · reported by GitHubMedium 4.9
Craft CMS is a content management system (CMS). From version 5.3.0 to before version 5.9.14, an authenticated control panel user with only accessCp can move entries across sections via POST /actions/entries/move-to-section, even when they do not have saveEntries:{sectionUid} permission for either source or destination section. This issue has been patched in version 5.9.14.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Craft CMS is a content management system (CMS).CVE-2026-33161 · Other software · craftcms · reported by GitHubLow 1.3
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can call assets/image-editor with the ID of a private asset they cannot view and still receive editor response data, including focalPoint. The endpoint returns private editing metadata without per-asset authorization validation. This issue has been patched in versions 4.17.8 and 5.9.14.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Craft CMS is a content management system (CMS).CVE-2026-33160 · Other software · craftcms · reported by GitHubLow 2.7
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, an unauthenticated user can call assets/generate-transform with a private assetId, receive a valid transform URL, and fetch transformed image bytes. The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL. This issue has been patched in versions 4.17.8 and 5.9.14.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Craft CMS is a content management system (CMS).CVE-2026-33159 · Other software · craftcms · reported by GitHubMedium 6.9
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, guest users can access Config Sync updater index, obtain signed data, and execute state-changing Config Sync actions (regenerate-yaml, apply-yaml-changes) without authentication. This issue has been patched in versions 4.17.8 and 5.9.14.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Craft CMS is a content management system (CMS).CVE-2026-33158 · Other software · craftcms · reported by GitHubMedium 4.9
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized to view. The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files. This issue has been patched in versions 4.17.8 and 5.9.14.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Craft CMS is a content management system (CMS).CVE-2026-33157 · Other software · craftcms · reported by GitHubHigh 8.6
Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.13, a Remote Code Execution (RCE) vulnerability exists in Craft CMS, it can be exploited by any authenticated user with control panel access. This is a bypass of a previous fix. The existing patches add cleanseConfig() to assembleLayoutFromPost() and various FieldsController actions to strip Yii2 behavior/event injection keys ("as" and "on" prefixed keys). However, the fieldLayouts parameter in ElementIndexesController::actionFilterHud() is passed directly to FieldLayout::createFromConfig() without any sanitization, enabling the same behavior injection attack chain. This issue has been patched in version 5.9.13.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33700 · Other software · go-vikunja · reported by GitHubMedium 6.9
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DELETE /api/v1/projects/:project/shares/:share` endpoint does not verify that the link share belongs to the project specified in the URL. An attacker with admin access to any project can delete link shares from other projects by providing their own project ID combined with the target share ID. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33680 · Other software · go-vikunja · reported by GitHubHigh 7.5
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenticated users to list all link shares for a project, including their secret hashes. While `LinkSharing.CanRead()` correctly blocks link share users from reading individual shares via `ReadOne`, the `ReadAllWeb` handler bypasses this check by never calling `CanRead()`. An attacker with a read-only link share can retrieve hashes for write or admin link shares on the same project and authenticate with them, escalating to full admin access. Version 2.2.2 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33679 · Other software · go-vikunja · reported by GitHubMedium 6.4
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DownloadImage` function in `pkg/utils/avatar.go` uses a bare `http.Client{}` with no SSRF protection when downloading user avatar images from the OpenID Connect `picture` claim URL. An attacker who controls their OIDC profile picture URL can force the Vikunja server to make HTTP GET requests to arbitrary internal or cloud metadata endpoints. This bypasses the SSRF protections that are correctly applied to the webhook system. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33678 · Other software · go-vikunja · reported by GitHubHigh 8.1
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id = ?`), ignoring the task ID from the URL path. The permission check in `CanRead()` validates access to the task specified in the URL, but `ReadOne()` loads a different attachment that may belong to a task in another project. This allows any authenticated user to download or delete any attachment in the system by providing their own accessible task ID with a target attachment ID. Attachment IDs are sequential integers, making enumeration trivial. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33677 · Other software · go-vikunja · reported by GitHubMedium 6.5
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `GET /api/v1/projects/:project/webhooks` endpoint returns webhook BasicAuth credentials (`basic_auth_user` and `basic_auth_password`) in plaintext to any user with read access to the project. While the existing code correctly masks the HMAC `secret` field, the BasicAuth fields added in a later migration were not given the same treatment. This allows read-only collaborators to steal credentials intended for authenticating against external webhook receivers. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33676 · Other software · go-vikunja · reported by GitHubMedium 6.5
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the `related_tasks` field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks' projects. An authenticated user who can read a task that has cross-project relations will receive full details (title, description, due dates, priority, percent completion, project ID, etc.) of tasks in projects they have no access to. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33675 · Other software · go-vikunja · reported by GitHubMedium 6.4
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions `DownloadFile` and `DownloadFileWithHeaders` in `pkg/modules/migration/helpers.go` make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33668 · Other software · go-vikunja · reported by GitHubHigh 7.1
Vikunja is an open-source self-hosted task management platform. Starting in version 0.18.0 and prior to version 2.2.1, when a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue accessing the API and syncing data. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33474 · Other software · go-vikunja · reported by GitHubMedium 6.5
Vikunja is an open-source self-hosted task management platform. Starting in version 1.0.0-rc0 and prior to version 2.2.0, unbounded image decoding and resizing during preview generation lets an attacker exhaust CPU and memory with highly compressed but extremely large-dimension images. Version 2.2.0 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33473 · Other software · go-vikunja · reported by GitHubMedium 5.7
Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33336 · Other software · go-vikunja · reported by GitHubMedium 6.5
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables `nodeIntegration` in the main BrowserWindow and does not restrict same-window navigations. An attacker who can place a link in user-generated content (task descriptions, comments, project descriptions) can cause the BrowserWindow to navigate to an attacker-controlled origin, where JavaScript executes with full Node.js access, resulting in arbitrary code execution on the victim's machine. Version 2.2.0 patches the issue. ## Root cause Two misconfigurations combine to create this vulnerability: 1. **`nodeIntegration: true`** is set in `BrowserWindow` web preferences (`desktop/main.js:14-16`), giving any page loaded in the renderer full access to Node.js APIs (`require`, `child_process`, `fs`, etc.). 2. **No `will-navigate` or `will-redirect` handler** is registered on the `webContents`. The existing `setWindowOpenHandler` (`desktop/main.js:19-23`) only intercepts `window.open()` calls (new-window requests). It does **not** intercept same-window navigations triggered by: - `<a href="https://...">` links (without `tar
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33335 · Other software · go-vikunja · reported by GitHubMedium 6.4
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from `window.open()` calls directly to `shell.openExternal()` without any validation or protocol allowlisting. An attacker who can place a link with `target="_blank"` (or that otherwise triggers `window.open`) in user-generated content can cause the victim's operating system to open arbitrary URI schemes, invoking local applications, opening local files, or triggering custom protocol handlers. Version 2.2.0 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33334 · Other software · go-vikunja · reported by GitHubMedium 6.5
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables `nodeIntegration` in the renderer process without `contextIsolation` or `sandbox`. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33316 · Other software · go-vikunja · reported by GitHubHigh 8.1
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regain access to their accounts. The `ResetPassword()` function sets the user’s status to `StatusActive` after a successful password reset without verifying whether the account was previously disabled. By requesting a reset token through `/api/v1/user/password/token` and completing the reset via `/api/v1/user/password/reset`, a disabled user can reactivate their account and bypass administrator-imposed account disablement. Version 2.2.0 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33315 · Other software · go-vikunja · reported by GitHubMedium 6.9
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, the Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access standard project information that would normally be protected behind 2FA (if enabled), such as project name, description, etc. Version 2.2.0 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33313 · Other software · go-vikunja · reported by GitHubMedium 5.3
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to. Version 2.2.0 fixes the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026iCMS v8.0.0 contains a Cross-Site Scripting (XSS) vulnerability in the User Management component, specifically within the index.html file.CVE-2026-30661 · Other software · Idreamsoft · reported by MITREMedium 6.1
iCMS v8.0.0 contains a Cross-Site Scripting (XSS) vulnerability in the User Management component, specifically within the index.html file. This allows remote attackers to execute arbitrary web script or HTML via the regip or loginip parameters.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Out-of-bounds Write vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.CVE-2026-4756 · Other software · MolotovCherry · reported by cve_disclosure@tech.gov.sgHigh 7.8
Out-of-bounds Write vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.
- Product
- Android-ImageMagick7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026CWE-20 vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.CVE-2026-4755 · Other software · MolotovCherry · reported by cve_disclosure@tech.gov.sgCritical 9.8
CWE-20 vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.
- Product
- Android-ImageMagick7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026CWE-79 vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.CVE-2026-4754 · Other software · MolotovCherry · reported by cve_disclosure@tech.gov.sgMedium 6.1
CWE-79 vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.
- Product
- Android-ImageMagick7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Missing Release of Memory after Effective Lifetime vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.CVE-2026-33852 · Other software · MolotovCherry · reported by cve_disclosure@tech.gov.sgHigh 7.5
Missing Release of Memory after Effective Lifetime vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.
- Product
- Android-ImageMagick7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Missing Release of Memory after Effective Lifetime vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.CVE-2026-33856 · Other software · MolotovCherry · reported by cve_disclosure@tech.gov.sgHigh 7.5
Missing Release of Memory after Effective Lifetime vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.
- Product
- Android-ImageMagick7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Integer Overflow or Wraparound vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.CVE-2026-33855 · Other software · MolotovCherry · reported by cve_disclosure@tech.gov.sgMedium 5.5
Integer Overflow or Wraparound vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.
- Product
- Android-ImageMagick7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Out-of-bounds Write vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-10.CVE-2026-33854 · Other software · MolotovCherry · reported by cve_disclosure@tech.gov.sgHigh 8.8
Out-of-bounds Write vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-10.
- Product
- Android-ImageMagick7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026NULL Pointer Dereference vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-10.CVE-2026-33853 · Other software · MolotovCherry · reported by cve_disclosure@tech.gov.sgMedium 5.5
NULL Pointer Dereference vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-10.
- Product
- Android-ImageMagick7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship-Management-System up to 1b4679c4d06b90d31dd521c2b000bfdec5a36e00.CVE-2026-4623 · Other software · DefaultFuction · reported by VulDBMedium 5.5
A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship-Management-System up to 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. This affects an unknown function of the file /api/System.php of the component API Module. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The identifier of the patch is f76e7123fe093b8675f88ec8f71725b0dd186310/98bd4eb07fa19d4f2c5228de6395580013c97476. It is suggested to install a patch to address this issue.
- Product
- Jeson-Customer-Relationship-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Action Pack is a Rubygem for building web applications on the Rails framework.CVE-2026-33167 · Other software · rails · reported by GitHubLow 1.3
Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.
- Product
- actionpack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2026-33046 · Other software · indico · reported by GitHubHigh 7.7
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12, due to vulnerabilities in TeXLive and obscure LaTeX syntax that allowed circumventing Indico's LaTeX sanitizer, it is possible to use specially-crafted LaTeX snippets which can read local files or execute code with the privileges of the user running Indico on the server. Note that if server-side LaTeX rendering is not in use (ie `XELATEX_PATH` was not set in `indico.conf`), this vulnerability does not apply. It is recommended to update to Indico 3.3.12 as soon as possible. It is also strongly recommended to enable the containerized LaTeX renderer (using `podman`), which isolates it from the rest of the system. As a workaround, remove the `XELATEX_PATH` setting from `indico.conf` (or comment it out or set it to `None`) and restart the `indico-uwsgi` and `indico-celery` services to disable LaTeX functionality.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Connect-CMS is a content management system.CVE-2026-32300 · Other software · opensource-workshop · reported by GitHubHigh 8.1
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information. Versions 1.41.1 and 2.41.1 contain a patch.
- Product
- connect-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Connect-CMS is a content management system.CVE-2026-32299 · Other software · opensource-workshop · reported by GitHubHigh 7.5
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the page content retrieval feature may allow retrieval of non-public information. Versions 1.41.1 and 2.41.1 contain a patch.
- Product
- connect-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.