Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

3,170 results · page 8 of 64

Jul 24, 2026Project Management, Bug and Issue Tracking: Does not sanitise and escape user supplied input before using it in a SQL queryCVE-2026-12877 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.
Product
Project Management, Bug and Issue Tracking
Fixed in
5.1.0
What to do
Update Project Management, Bug and Issue Tracking to 5.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions.CVE-2026-57370 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions.
Affected
up to 11.9.1
What to do
Affects up to 11.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 21, 2026Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Higher Ed Statistics Agency - UK HESA).CVE-2026-60605 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Higher Ed Statistics Agency - UK HESA). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Student Records accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Product
PeopleSoft Enterprise CS Student Records
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Jul 21, 2026Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to triCVE-2026-65049 · WordPress plugins & themes · reported by VulnCheckHigh 8.4
Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce to invoke migration routines that unconditionally iterate all blogs via switch_to_blog(), dropping all nf3_* tables and clearing options and transients across every subsite in the network without requiring super-admin or network-admin privileges.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 21, 2026Free Builder for Elementor: Does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboardCVE-2026-11767 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.
Product
Free Builder for Elementor
Fixed in
1.6.7
What to do
Update Free Builder for Elementor to 1.6.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026All-in-One WP Migration and Backup: Does not properly sanitise a user-supplied value before using it to build a file pathCVE-2026-12898 · WordPress plugins & themes · reported by WPScanMedium 6.5
The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.
Product
All-in-One WP Migration and Backup
Fixed in
7.106
What to do
Update All-in-One WP Migration and Backup to 7.106 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026Kirki: Does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sendsCVE-2026-12724 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.
Product
Kirki
Fixed in
6.0.12
What to do
Update Kirki to 6.0.12 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite: Do not sanitise and escape a request parameter before using it in a SQL statementCVE-2026-11349 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.
Product
Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite
Fixed in
7.34.0
What to do
Update Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite to 7.34.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 19, 2026In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMT_OP_ADD_EXT_ADV_DATA isCVE-2026-64126 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.3
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command, with MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header size. The handler then uses cp->adv_data_len and cp->scan_rsp_len to validate and copy cp->data, but it never checks that those bytes are part of the mgmt command payload. A short command can therefore make add_ext_adv_data() pass an out-of-bounds pointer into tlv_data_is_valid(). If the bytes beyond the command buffer are addressable, they can also be copied into the advertising instance as scan response data, where the caller can read them back via MGMT_OP_GET_ADV_INSTANCE. The trigger requires CAP_NET_ADMIN in the initial user namespace; KASAN reports an 8-byte slab-out-of-bounds read. Reject commands whose length does not match the fixed header plus both advertising data lengths before parsing cp->data.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jul 17, 2026NEX-Forms: Does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboardCVE-2026-10525 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators when they view the submitted entries.
Product
NEX-Forms
Fixed in
9.2.3
What to do
Update NEX-Forms to 9.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 16, 2026BetterDocs: Does not sanitise an AI-generated documentation summary before storing and outputting itCVE-2026-11371 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BetterDocs WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and outputting it, and the feature that generates it is exposed to unauthenticated users, allowing them to store a malicious payload via prompt injection that executes in the browser of any visitor who views the affected page, including administrators.
Product
BetterDocs
Fixed in
4.5.5
What to do
Update BetterDocs to 4.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Jul 15, 2026A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSCVE-2026-59838 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5.9
A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Product
FortiSIEM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.fortinet.com
Jul 14, 2026A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to CVE-2026-59841 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.5
A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to escalation of privilege via <insert attack vector here>
Product
FortiSIEMWindowsAgent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.fortinet.com
Jul 14, 2026A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticatedCVE-2026-59835 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.6
A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests.
Product
FortiSandbox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.fortinet.com
Jul 13, 2026OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists.CVE-2026-62196 · Other software · OpenClaw · reported by VulnCheckHigh 8.7
OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected feature.
Product
OpenClaw
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jul 13, 2026In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ paraCVE-2026-14846 · Websites & servers · reported by cve-coordination@incibe.esMedium 4.5
In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the information is exported using the ‘Get my data in CSV’ tool. Successful exploitation of this vulnerability could facilitate unauthorised access to the victim’s personal data.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Jul 10, 2026TypeBot is a chatbot builder tool.CVE-2026-49213 · Other software · baptisteArno · reported by GitHubHigh 8.1
TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF validator in packages/lib/src/ssrf/validateHttpReqUrl.ts can be bypassed with the IPv6 unspecified address :: because validateIPAddress blocks local, metadata, and private ranges but does not block :: or its expanded form. A workspace editor or creator can configure a server-side HTTP Request block or guarded script fetch to make the Typebot server connect to local HTTP services through safeKy, including flows triggered by POST /v1/typebots/{publicId}/startChat or POST /v1/sessions/{sessionId}/continueChat. This issue is fixed in version 3.17.2.
Product
typebot.io
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 8, 2026App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes.CVE-2026-49147 · Other software · PETDANCE · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitises the filenames printed by -f, -g, the colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename. A file whose name embeds cursor-movement or color escapes can overwrite or recolor earlier terminal output, or be passed unchanged to a downstream consumer.
Product
App::Ack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record metacpan.org openwall.com
Jul 6, 2026Ultimate Member: Does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profilesCVE-2026-11766 · WordPress plugins & themes · reported by WPScanHigh 8
The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.
Product
Ultimate Member
Fixed in
2.12.0
What to do
Update Ultimate Member to 2.12.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 3, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency DCVE-2026-4322 · Other software · Raera - Ankara Web Design and Digital Advertising Agency · reported by iletisim@usom.gov.trMedium 6.1
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency Destekz allows Reflected XSS. This issue affects Destekz: through 02062026. NOTE: The vendor was contacted and it was learned that the product is not supported.
Product
Destekz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr
Jul 3, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency DCVE-2026-4321 · Other software · Raera - Ankara Web Design and Digital Advertising Agency · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency Destekz allows SQL Injection. This issue affects Destekz: through 02062026. NOTE: The vendor was contacted and it was learned that the product is not supported.
Product
Destekz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr
Jul 1, 2026A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing.CVE-2026-14258 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.
Product
Red Hat Enterprise Linux 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jun 30, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not sanitise a form field's caption before outputting itCVE-2026-11581 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.
Product
Kali Forms — Contact Form & Drag-and-Drop Builder
Fixed in
2.4.13
What to do
Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.13 or newer.
Full record and what to do →NVD record wpscan.com
Jun 29, 2026Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob incrCVE-2026-57959 · Other software · HiEventsDev · reported by VulnCheckHigh 8.2
Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob increments it, allowing attackers to redeem limited promo codes unlimited times. Attackers can sequentially reserve multiple orders with the same restricted promo code, each reading order_usage_count=0 and passing validation, then complete them all at discounted prices without concurrent requests.
Product
Hi.Events
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jun 29, 2026Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table with an always-satisfied _or condition that bypasses operationCVE-2026-57951 · Other software · its-a-feature · reported by VulnCheckHigh 7.1
Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table with an always-satisfied _or condition that bypasses operation-scoped access controls. Authenticated operators and spectators can query payload_build_step to read step_stdout, step_stderr, step_name, and step_description across all operations on the server.
Product
Mythic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 26, 2026SALESmanago & Leadoo: Does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statementCVE-2026-10835 · WordPress plugins & themes · reported by WPScanHigh 7.7
The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statement, and fails to enforce authorisation on that action, allowing authenticated users with minimal permissions, such as subscribers, to perform SQL injection attacks.
Product
SALESmanago & Leadoo
Fixed in
3.11.3
What to do
Update SALESmanago & Leadoo to 3.11.3 or newer.
Full record and what to do →NVD record wpscan.com
Jun 25, 2026A missing sanitisation vulnerability exists with user input in the stats-video.php script.CVE-2026-50745 · Other software · Revive · reported by support@hackerone.comMedium 6.1
A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input to be reflected without escaping.
Product
Adserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com
Jun 25, 2026A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier.CVE-2026-50740 · Other software · Revive · reported by support@hackerone.comMedium 5.4
A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier. A low‑privileged user could exploit the refresh parameter of the iFrame invocation tag to perform reflected XSS attacks.
Product
Adserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com
Jun 25, 2026In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate advertising TLV before type checks tlv_data_is_valid() reads eacCVE-2026-53255 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate advertising TLV before type checks tlv_data_is_valid() reads each advertising data field length from data[i], then inspects data[i + 1] for managed EIR types before checking that the current field still fits inside the supplied buffer. A malformed field whose length byte is the last byte of the buffer can therefore make the parser read one byte past the advertising data. KASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING request reached that path: BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid() Read of size 1 Call trace: tlv_data_is_valid() add_advertising() hci_mgmt_cmd() hci_sock_sendmsg() Move the existing element-length check before any type-octet inspection so each non-empty element is proven to contain its type byte before the parser looks at data[i + 1].
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jun 25, 2026In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising CVE-2026-53209 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising instances can already hold the maximum extended advertising payload. When hci_adv_bcast_annoucement() prepends the Broadcast Announcement service data to that payload, the combined data may no longer fit in the temporary buffer used to rebuild the advertising data. Reject that case before copying the existing payload and report the failure through the device log. This keeps the existing advertising data intact and avoids overrunning the temporary buffer.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jun 24, 2026Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters.CVE-2026-54297 · Other software · lostisland · reported by GitHubHigh 7.5
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth. A crafted query string causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught SystemStackError (stack level too deep), crashing the calling thread or worker. This can lead to denial of service in applications that pass attacker-controlled query strings to Faraday's nested query parsing or URL-building paths. This vulnerability is fixed in 1.10.6 and 2.14.3.
Product
faraday
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com access.redhat.com
Jun 24, 2026AI Share & Summarize: Does not sanitise and escape some of its shortcode attributes before outputting them in a pageCVE-2026-10531 · WordPress plugins & themes · reported by WPScanMedium 5.4
The AI Share & Summarize WordPress plugin before 2.0.4 does not sanitise and escape some of its shortcode attributes before outputting them in a page, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
AI Share & Summarize
Fixed in
2.0.4
What to do
Update AI Share & Summarize to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com
Jun 23, 2026dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an CVE-2026-56116 · Other software · NetworkConfiguration · reported by VulnCheckHigh 7.1
dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.
Product
dhcpcd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jun 23, 2026An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions werCVE-2026-44958 · Other software · Revive · reported by support@hackerone.comMedium 5.4
An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions. The status field has been removed from the hidden form fields in the banner edit screen.
Product
Adserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com
Jun 23, 2026A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to exploit the clientCVE-2026-34915 · Other software · Revive · reported by support@hackerone.comMedium 6.1
A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.
Product
Adserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com
Jun 23, 2026A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier.CVE-2026-34914 · Other software · Revive · reported by support@hackerone.comHigh 8.3
A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.
Product
Adserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com
Jun 23, 2026Frontend File Manager: Does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing itCVE-2026-8378 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability exploitable by users with Subscriber-level access and above against an administrator viewing the file management interface.
Product
Frontend File Manager
Affected
up to 23.6
What to do
Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 22, 2026ultimate-woocommerce-auction-pro: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2026-4259 · WordPress plugins & themes · reported by WPScanHigh 7.1
The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
ultimate-woocommerce-auction-pro
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update ultimate-woocommerce-auction-pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 22, 2026ultimate-woocommerce-auction-pro: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2026-4110 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
ultimate-woocommerce-auction-pro
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update ultimate-woocommerce-auction-pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 20, 2026Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distinguiCVE-2026-56319 · Other software · Capgo · reported by VulnCheckMedium 5.3
Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distinguish existing sibling app IDs through differential error responses. Attackers can enumerate real app IDs outside their allowed scope by observing 500 PGRST116 errors for inaccessible apps versus 401 errors for nonexistent apps, breaking tenant isolation.
Product
Capgo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jun 19, 2026Mercator is an open source web application that enables mapping of the information system.CVE-2026-49345 · Other software · sourcentis · reported by GitHubMedium 5.3
Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerability exists in Mercator's CVE configuration panel (`/admin/config/parameters`). The `testProvider()` method in `ConfigurationController` passes user-supplied input directly to `curl_init()` without validating the scheme, hostname, or destination IP address. An authenticated user with the `configure` permission can force the Mercator server to issue arbitrary outbound network requests. The suffix `/api/dbInfo` appended to the URL can be bypassed by injecting a `#` fragment character (e.g. `http://TARGET/PATH#`), allowing full control over the target URL. No scheme whitelist, host whitelist, or private/loopback IP block is applied. The `telnet://` scheme can be used for internal port scanning; the `gopher://` scheme enables interaction with unauthenticated internal services (Redis, Memcached), potentially leading to Remote Code Execution under specific deployment conditions. Version 2025.05.19 patches the issue.
Product
mercator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 19, 2026Mercator is an open source web application that enables mapping of the information system.CVE-2026-49344 · Other software · sourcentis · reported by GitHubHigh 7.1
Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine (`/admin/queries/execute`) accepts a JSON DSL (`from` / `select` / `filters` / `traverse` / `output`), translates it into an Eloquent query, and returns results as JSON. The controller method `QueryController::execute()` does not enforce an authorization gate, unlike `store()` and `massDestroy()` in the same controller which are correctly protected. As a result, any authenticated account — including the read-only Auditor role — can query models beyond its intended scope, including the `User` model. Additionally, the `password` column, although declared `$hidden`, is not excluded from filter predicates, which allows it to be used in `LIKE` conditions. The `schema()` and `schemaModel()` endpoints of the same controller are similarly unguarded. The Query Engine is read-only; integrity and availability are not affected. Version 2025.05.19 patches the issue.
Product
mercator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jun 19, 2026radvd is a router advertisement daemon for IPv6.CVE-2026-48715 · Other software · radvd-project · reported by GitHubHigh 7.7
radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.
Product
radvdump
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 17, 2026TypeBot is a chatbot builder tool.CVE-2026-48768 · Other software · baptisteArno · reported by GitHubCritical 9.3
TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized fileName input to construct public/ S3 object keys, while issuing presigned PUT URLs that do not bind Content-Type. As a result, any anonymous visitor to a published bot with a file input can upload attacker-controlled HTML, SVG, or JS to attacker-chosen subpaths, including other tenants’ publicly served result paths, enabling arbitrary content hosting and potential stored XSS on the storage origin. ../ traversal is blocked by S3/MinIO canonicalization (signature mismatch), but forward-slash path injection is exploitable. This issue has been fixed in version 3.17.0.
Product
typebot.io
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 17, 2026TypeBot is a chatbot builder tool.CVE-2026-48764 · Other software · baptisteArno · reported by GitHubHigh 8.2
TypeBot is a chatbot builder tool. In versions prior to 3.17.2, SSRF validation is implemented by resolving a hostname once and checking whether the resolved IP belongs to a forbidden range allowing for DNS rebinding bypass. The root cause is a time-of-check to time-of-use gap in the SSRF guard. The validator resolves the hostname and approves it, but the later request path performs a fresh resolution and connects to whatever IP the hostname maps to at that moment. The actual outbound request is then performed later using the original hostname, without pinning the validated IP to the network connection. An attacker who can supply a URL to a public bot that performs a server-side HTTP Request block or server-side script fetch can use DNS rebinding to pass the initial validation and still force the server to connect to a private or metadata address during the real request. This enables server-side access to private network services, cloud metadata endpoints, and other internal HTTP targets that the validator was intended to block. The exact downstream impact depends on the reachable internal services. Concrete consequences include metadata disclosure, access to internal admin panels,
Product
typebot.io
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 17, 2026TypeBot is a chatbot builder tool.CVE-2026-48759 · Other software · baptisteArno · reported by GitHubHigh 7.1
TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a non-guest member of the provided workspaceId, but then operate on themeTemplateId via Prisma queries that do NOT include workspaceId in the WHERE clause. This allows any authenticated user to modify or delete theme templates belonging to any other workspace and may expose Template IDs via shared typebots or network traffic. This issue has been fixed in version 3.16.0.
Product
typebot.io
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 17, 2026Taskbuilder: Does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodesCVE-2026-9570 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any logged-in user.
Product
Taskbuilder
Fixed in
5.0.8
What to do
Update Taskbuilder to 5.0.8 or newer.
Full record and what to do →NVD record wpscan.com
Jun 15, 2026Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.CVE-2026-52700 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 12, 2026Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enablingCVE-2026-49875 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.
Product
Apache CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Jun 12, 2026Secure Copy Content Protection and Content Locking: Does not sanitise and escape some of its settingsCVE-2026-9269 · WordPress plugins & themes · reported by WPScanLow 3.5
The Secure Copy Content Protection and Content Locking WordPress plugin before 5.1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Secure Copy Content Protection and Content Locking
Fixed in
5.1.5
What to do
Update Secure Copy Content Protection and Content Locking to 5.1.5 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.