Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,361 results · page 8 of 88
Sep 8, 2026A use-after-free security issue exists in the server's query execution memory tracking subsystem.CVE-2026-82061 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.2
A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Content Extractor contained a deserialization of untrusted data issue affecting privilege management.CVE-2026-77092 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333High 7.3
Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.
- Product
- Commvault Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.com
Sep 8, 2026The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths.CVE-2026-74859 · Other software · Red Hat · reported by Red HatMedium 6.8
The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside ~/.themes by using ../ path traversal, absolute paths, or symlink entries.
- Product
- Red Hat Enterprise Linux 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 7, 2026In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project AdminCVE-2026-86500 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.5
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permissionCVE-2026-86499 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permissionCVE-2026-86498 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.7
In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentCVE-2026-86497 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.8
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addressesCVE-2026-86496 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projectsCVE-2026-86495 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issuesCVE-2026-86494 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.7
In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cardsCVE-2026-86493 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokensCVE-2026-86492 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.5
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploadsCVE-2026-86491 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.5
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpointCVE-2026-86490 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizationsCVE-2026-86489 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searchesCVE-2026-86488 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas contentCVE-2026-86487 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.1
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blankCVE-2026-86486 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.7
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooksCVE-2026-86485 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.3
In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSSCVE-2026-86484 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possibleCVE-2026-86483 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalationCVE-2026-86482 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.8
In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project iconsCVE-2026-86481 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDORCVE-2026-86479 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserCVE-2026-86478 · Other software · JetBrains · reported by cve@jetbrains.comCritical 9.8
In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR ExtractionCVE-2026-77697 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 6.3
Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction
- Product
- ManageEngine Endpoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract CVE-2026-81939 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comCritical 9.1
A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.
- Product
- Network Security Manager (NSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.com
Sep 4, 2026undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from tCVE-2026-85008 · Other software · undici · reported by ce714d77-add3-4f53-aff5-83d477b104bbLow 3.7
undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to the full cache-read path. The response-storage gate also lacked a method check, so a response to an unsafe request that is heuristically cacheable or carries an explicit Cache-Control directive is stored and later replayed from cache. Because response headers from a remote origin are untrusted, an origin can answer once with a cacheable status and then have the client's own subsequent state-changing requests to that path served from the stale cache entry without ever reaching the origin, an integrity failure that occurs under the interceptor's default configuration. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Sep 4, 2026In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add data_len bound checks to activation parameter extractors nci_extract_activatCVE-2026-80796 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add data_len bound checks to activation parameter extractors nci_extract_activation_params_iso_dep() and nci_extract_activation_params_nfc_dep() read an inner length byte from the NCI RF_INTF_ACTIVATED_NTF payload and use it to memcpy() into fixed kernel buffers, but neither function receives the caller-validated activation_params_len. A crafted NCI notification with activation_params_len=1 and an inner length byte of up to 20 (NFC-A) or 50 (NFC-B) causes memcpy() to read that many bytes past the one valid byte in the activation params region -- a slab out-of-bounds read of kernel memory adjacent to the NCI skb. The sibling nci_extract_rf_params_*() family was given equivalent protection by commit 571dcbeb8e63 ("net: nfc: nci: Fix parameter validation for packet data"), but the two activation parameter extractors were not updated at that time. Add a data_len parameter to both functions, guard against an empty region before consuming the inner length byte, decrement the remaining count after consuming it, and clamp the copy length to what is actually available. Update both call sites to pass ntf.acti
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 4, 2026In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in ip_do_fragment() ip_do_fragment() subtracts the IPv4 headeCVE-2026-80793 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in ip_do_fragment() ip_do_fragment() subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ip_frag_next(). If the effective MTU is smaller than hlen + 8, ip_frag_next() rounds the fragment payload length down to zero. The fragmentation state then never makes forward progress: state->left, state->ptr and state->offset stay unchanged while ip_do_fragment() keeps allocating and transmitting header-only fragments until the softlockup detector fires. This is reproducible with a route installed using "mtu lock 20", but it is also reproducible without route MTU lock, for example by forwarding a packet to a device whose MTU is 20. Fix it in ip_do_fragment() by rejecting mtu < hlen + 8 with -EMSGSIZE, matching the existing IPv6 fragmentation check.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 4, 2026LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output deCVE-2026-85694 · Other software · lavague-ai · reported by VulnCheckCritical 9.2
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute arbitrary code on the operator's host without review.
- Product
- LaVague
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that fetches caller-supplied URLs withCVE-2026-85675 · Other software · camel-ai · reported by VulnCheckHigh 8.7
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources, with responses returned to the agent context.
- Product
- owl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation.CVE-2026-85663 · Other software · aimhubio · reported by VulnCheckCritical 9.3
Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs.
- Product
- aim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the sCVE-2026-85456 · Other software · moos-ivp · reported by VulnCheckMedium 6.8
MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems.
- Product
- moos-ivp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE_REPORT messages, allowing attackers to exhaust memory by suCVE-2026-85449 · Other software · moos-ivp · reported by VulnCheckHigh 8.7
MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE_REPORT messages, allowing attackers to exhaust memory by supplying unbounded distinct node names. Attackers can publish crafted NODE_REPORT data to cause memory exhaustion and stall the operator display without authentication.
- Product
- moos-ivp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix compariCVE-2026-85396 · Other software · rubyzip · reported by VulnCheckHigh 8.7
rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix.
- Product
- rubyzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer.CVE-2026-53706 · Other software · vbpf · reported by GitHubHigh 8.8
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the prevail eBPF verifier accepts ALU32 ADD and SUB instructions that operate on pointer-typed registers without checking the is64 flag. Because ALU32 arithmetic zero-extends the 32-bit result, the upper half of any pointer is silently destroyed at runtime, yet prevail marks the program as verified safe. Any caller that can submit an eBPF program for verification — including unprivileged users on kernels that permit BPF program loading — can produce a program that passes verification but faults or misbehaves at runtime. This issue has been patched in version 0.2.4.
- Product
- prevail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer.CVE-2026-53671 · Other software · vbpf · reported by GitHubCritical 9.3
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a T_CTX-typed base register as a silent no-op: do_mem_store in src/crab/ebpf_transformer.cpp only models T_STACK stores, and the checker's T_CTX bounds arm never tests AccessType::write. An attacker can craft an eBPF program that overwrites a context field (e.g., ctx->data), reload that field typed as T_PACKET, and dereference an attacker-controlled address — and prevail will report the program as safe. This issue has been patched in version 0.2.4.
- Product
- prevail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer.CVE-2026-53670 · Other software · vbpf · reported by GitHubCritical 9.3
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset (two or more simultaneously possible pointer types). Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime. This issue has been patched in version 0.2.4.
- Product
- prevail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences eCVE-2026-84805 · Other software · kimai · reported by VulnCheckMedium 5.3
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permission check, so an authenticated regular user can use the API to modify their own admin-only work-contract data. The issue is fixed in 2.63.0 by applying the same permission check to the API endpoint.
- Product
- kimai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 2, 2026GamiPress: Does not properly restrict its video watch-tracking functionalityCVE-2026-77764 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them without limit.
- Product
- GamiPress
- Fixed in
- 7.9.9.6
- What to do
- Update GamiPress to 7.9.9.6 or newer.
Sep 1, 2026In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL.CVE-2026-14957 · Other software · The Libreswan Project · reported by d42dc95b-23f1-4e06-9076-20753a0fb0dfHigh 7.5
In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service. No remote code execution is possible. Both IKEv1 and IKEv2 are affected. The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable.
- Product
- libreswan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlibreswan.orglibreswan.org
Sep 1, 2026An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malfoCVE-2026-11873 · Other software · Red Hat · reported by Red HatMedium 6.5
An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification resource exhaustion vector (disk growth and I/O contention) without requiring authentication.
- Product
- Red Hat Certificate System 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 1, 2026WP Fastest Cache: Does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with themCVE-2026-74916 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
- Product
- WP Fastest Cache
- Fixed in
- 1.5.1
- What to do
- Update WP Fastest Cache to 1.5.1 or newer.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-77353 · Other software · ellite · reported by GitHubMedium 4.6
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input validation layer only encodes HTML metacharacters but never strips newlines, and the export layer decodes those entities back before writing iCal output, an attacker with any valid account can craft a subscription whose name breaks out of the current VEVENT block and inserts fully attacker-controlled calendar events — including spoofed organizers, arbitrary email addresses in ATTENDEE properties, and misleading event content — into any calendar application subscribed to that feed. This issue has been patched in version 5.0.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-77352 · Other software · ellite · reported by GitHubMedium 4.3
Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user (no admin rights required) can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of their personal email notifications to an internal IP. The per-user notification settings endpoint (endpoints/notifications/saveemailnotifications.php) performs no SSRF validation, and the notification cron (endpoints/cronjobs/sendnotifications.php) feeds that user-controlled host straight into PHPMailer ($mail->Host = $email['smtpAddress']). When the user's subscription notification fires, the server connects to the chosen host:port. This issue has been patched in version 5.0.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-77351 · Other software · ellite · reported by GitHubLow 3.5
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation. When the scheduled notification cron job runs, it passes the stored host directly to PHPMailer, causing the Wallos server to open an outbound TCP connection to whatever address the attacker specified. This gives a low-privileged attacker a reliable mechanism to probe internal network services from the server's perspective. This issue has been patched in version 5.0.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-77348 · Other software · ellite · reported by GitHubHigh 8.2
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable") hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPT_PROXY = '' + CURLOPT_NOPROXY = '*'). However, Wallos ships a second, near-identical, unauthenticated logo-image search endpoint — endpoints/payments/search.php — that was not given the same hardening. It still passes the HTTP_PROXY/HTTPS_PROXY environment variable straight into CURLOPT_PROXY. This issue has been patched in version 5.0.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-61641 · Other software · ellite · reported by GitHubHigh 8.1
Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin — full account takeover, no password needed. This issue has been patched in version 4.9.6.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-61640 · Other software · ellite · reported by GitHubHigh 8.5
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php:18-49 are used directly in curl_init() with zero SSRF filtering. Unlike logo/webhook URLs which have validate_webhook_url_for_ssrf(), OIDC URLs bypass all protections. Admin sets URL to http://169.254.169.254/latest/meta-data/ for cloud metadata access or internal network pivoting. This issue has been patched in version 4.9.6.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.