Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,315 results · page 81 of 347
Mar 18, 2026A command injection vulnerability exists in the web management interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02).CVE-2026-30703 · Other software · reported by MITRECritical 9.8
A command injection vulnerability exists in the web management interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02). The adm.cgi endpoint improperly sanitizes user-supplied input provided to a command-related parameter in the sysCMD functionality.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmstreet97.github.iomade-in-china.com
Mar 18, 2026The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication mechanism in its web management interface.CVE-2026-30702 · Other software · reported by MITRECritical 9.8
The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication mechanism in its web management interface. The login page does not properly enforce session validation, allowing attackers to bypass authentication by directly accessing restricted web application endpoints through forced browsing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmstreet97.github.iomade-in-china.com
Mar 18, 2026In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged CVE-2026-23268 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unprivileged local user can do privileged policy management An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confused deputy attack, by passing the opened fd to a privileged process, and getting the privileged process to write to the interface. This does require a privileged target that can be manipulated to do the write for the unprivileged process, but once such access is achieved full policy management is possible and all the possible implications that implies: removing confinement, DoS of system or target applications by denying all execution, by-passing the unprivileged user namespace restriction, to exploiting kernel bugs for a local privilege escalation. The policy management interface can not have its permissions simply changed from 0666 to 0600 because non-root processes need to be able to load policy to different policy namespaces. Instead ensure the task writing the interface has privileges that are a subset of the task that opened the interface. This is already done via policy for confined processes, but unconfined can deleg
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 18, 2026KiviCare – Clinic & Patient Management System (EHR): Privilege EscalationCVE-2026-2992 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the `/wp-json/kivicare/v1/setup-wizard/clinic` REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to create a new clinic and a WordPress user with clinic admin privileges.
- Product
- KiviCare – Clinic & Patient Management System (EHR)
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 18, 2026KiviCare – Clinic & Patient Management System (EHR): Authentication BypassCVE-2026-2991 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2. This is due to the `patientSocialLogin()` function not verifying the social provider access token before authenticating a user. This makes it possible for unauthenticated attackers to log in as any patient registered on the system by providing only their email address and an arbitrary value for the access token, bypassing all credential verification. The attacker gains access to sensitive medical records, appointments, prescriptions, and billing information (PII/PHI breach). Additionally, authentication cookies are set before the role check, meaning the auth cookies for non-patient users (including administrators) are also set in the HTTP response headers, even though a 403 response is returned.
- Product
- KiviCare – Clinic & Patient Management System (EHR)
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 18, 2026MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attackersCVE-2025-55041 · Other software · Murasoftware · reported by MITREHigh 8
MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attackers to escalate privileges by adding any user to any group without proper authorization checks. The vulnerable function lacks CSRF token validation and directly processes user-supplied userId and groupId parameters via getUserManager().createUserInGorup(), enabling malicious websites to forge requests that automatically execute when an authenticated administrator visits a crafted page. Adding a user to the Super Admins group (s2 user) is not possible. Successful exploitation results in the attacker gaining privilege escalation both horizontally to other groups and vertically to the admin group. Escalation to the s2 User group is not possible.
- Product
- Mura CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.murasoftware.commurasoftware.com
Mar 18, 2026A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initCVE-2026-32691 · Other software · Canonical · reported by security@ubuntu.comMedium 5.3
A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. Between generating a Juju Secret ID and creating the secret's first revision, an attacker authenticated as another unit agent can claim ownership of a known secret. This leads to the attacking unit being able to read the content of the initial secret revision.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuCVE-2026-4366 · Other software · Red Hat · reported by Red HatMedium 5.8
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
- Product
- Red Hat build of Keycloak 26.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Mar 18, 2026Kanboard is project management software focused on Kanban methodology.CVE-2026-33058 · Other software · kanboard · reported by GitHubHigh 8.4
Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection vulnerability. Attackers with the permission to add users to a project can leverage this vulnerability to dump the entirety of the kanboard database. Version 1.2.51 fixes the issue.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026Cockpit is a headless content management system.CVE-2026-31891 · Other software · Cockpit-HQ · reported by GitHubHigh 7.7
Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected by a a SQL Injection vulnerability in the MongoLite Aggregation Optimizer. Any deployment where the `/api/content/aggregate/{model}` endpoint is publicly accessible or reachable by untrusted users may be vulnerable, and attackers in possession of a valid read-only API key (the lowest privilege level) can exploit this vulnerability — no admin access is required. An attacker can inject arbitrary SQL via unsanitized field names in aggregation queries, bypass the `_state=1` published-content filter to access unpublished or restricted content, and extract unauthorized data from the underlying SQLite content database. This vulnerability has been patched in version 2.13.5. The fix applies the same field-name sanitization introduced in v2.13.3 for `toJsonPath()` to the `toJsonExtractRaw()` method in `lib/MongoLite/Aggregation/Optimizer.php`, closing the injection vector in the Aggregation Optimizer.
- Product
- Cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026Kanboard is project management software focused on Kanban methodology.CVE-2026-29056 · Other software · kanboard · reported by GitHubHigh 7
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registration endpoint (`UserInviteController::register()`) accepts all POST parameters and passes them to `UserModel::create()` without filtering out the `role` field. An attacker who receives an invite link can inject `role=app-admin` in the registration form to create an administrator account. Version 1.2.51 fixes the issue.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026GLPI is a free Asset and IT management software package.CVE-2026-25937 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026Edimax GS-5008PL firmware versions 1.00.54 and prior contain an authentication bypass vulnerability that allows unauthenticated attackers to access the managemeCVE-2026-32841 · Other software · EDIMAX Technology Co., Ltd. · reported by VulnCheckCritical 9.2
Edimax GS-5008PL firmware versions 1.00.54 and prior contain an authentication bypass vulnerability that allows unauthenticated attackers to access the management interface. Attackers can exploit the global authentication flag mechanism to gain administrative access without credentials after any user authenticates, enabling unauthorized password changes, firmware uploads, and configuration modifications.
- Product
- Edimax GS-5008PL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026Edimax GS-5008PL firmware version 1.00.54 and prior use cleartext HTTP for the web management interface without implementing TLS or SSL encryption.CVE-2026-32838 · Other software · EDIMAX Technology Co., Ltd. · reported by VulnCheckHigh 8.7
Edimax GS-5008PL firmware version 1.00.54 and prior use cleartext HTTP for the web management interface without implementing TLS or SSL encryption. Attackers on the same network can intercept management traffic to capture administrator credentials and sensitive configuration data.
- Product
- Edimax GS-5008PL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026GLPI is a free Asset and IT management software package.CVE-2026-25936 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Version 11.0.6 fixes the issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026Configuration issue in Java Management Extensions (JMX) in TIBCO BPM Enterprise version 4.x allows unauthorised access.CVE-2026-3207 · Other software · TIBCO · reported by security@tibco.comHigh 8.7
Configuration issue in Java Management Extensions (JMX) in TIBCO BPM Enterprise version 4.x allows unauthorised access.
- Product
- TIBCO BPM Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A security vulnerability has been detected in Tiandy Easy7 Integrated Management Platform up to 7.17.0.CVE-2026-4289 · Other software · Tiandy · reported by VulDBMedium 5.5
A security vulnerability has been detected in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This affects an unknown function of the file /rest/preSetTemplate/getRecByTemplateId. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easy7 Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A weakness has been identified in Tiandy Easy7 Integrated Management Platform 7.17.0.CVE-2026-4288 · Other software · Tiandy · reported by VulDBMedium 5.5
A weakness has been identified in Tiandy Easy7 Integrated Management Platform 7.17.0. The impacted element is an unknown function of the file /rest/devStatus/getDevDetailedInfo of the component Endpoint. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easy7 Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A security flaw has been discovered in Tiandy Easy7 Integrated Management Platform 7.17.0.CVE-2026-4287 · Other software · Tiandy · reported by VulDBMedium 5.5
A security flaw has been discovered in Tiandy Easy7 Integrated Management Platform 7.17.0. The affected element is an unknown function of the file /rest/devStatus/queryResources of the component Endpoint. Performing a manipulation of the argument areaId results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easy7 Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026ZwickRoell Test Data Management versions prior to 3.0.8 contain a local file inclusion (LFI) vulnerability in the /server/node_upgrade_srv.js endpoint.CVE-2026-29522 · Other software · ZwickRoell GmbH & Co. KG · reported by VulnCheckHigh 8.7
ZwickRoell Test Data Management versions prior to 3.0.8 contain a local file inclusion (LFI) vulnerability in the /server/node_upgrade_srv.js endpoint. An unauthenticated attacker can supply directory traversal sequences via the firmware parameter to access arbitrary files on the server, leading to information disclosure of sensitive system files.
- Product
- Test Data Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncheck.comzwickroell.com
Mar 16, 2026Craft CMS is a content management system (CMS).CVE-2026-32267 · Other software · craftcms · reported by GitHubHigh 7.7
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing UsersController->actionImpersonateWithToken. This issue has been patched in versions 4.17.6 and 5.9.12.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Craft CMS is a content management system (CMS).CVE-2026-32264 · Other software · craftcms · reported by GitHubHigh 8.6
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in versions 4.17.5 and 5.9.11.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Craft CMS is a content management system (CMS).CVE-2026-32263 · Other software · craftcms · reported by GitHubHigh 8.6
Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.11, in src/controllers/EntryTypesController.php, the $settings array from parse_str is passed directly to Craft::configure() without Component::cleanseConfig(). This allows injecting Yii2 behavior/event handlers via "as" or "on" prefixed keys, the same attack vector as the original advisory. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in version 5.9.11.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Craft CMS is a content management system (CMS).CVE-2026-32262 · Other software · craftcms · reported by GitHubMedium 5.3
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, the AssetsController->replaceFile() method has a targetFilename body parameter that is used unsanitized in a deleteFile() call before Assets::prepareAssetName() is applied on save. This allows an authenticated user with replaceFiles permission to delete arbitrary files within the same filesystem root by injecting ../ path traversal sequences into the filename. This could allow an authenticated user with replaceFiles permission on one volume to delete files in other folders/volumes that share the same filesystem root. This only affects local filesystems. This issue has been patched in versions 4.17.5 and 5.9.11.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Chamilo LMS is a learning management system.CVE-2026-30882 · Other software · chamilo · reported by GitHubMedium 6.1
Chamilo LMS is a learning management system. Chamilo LMS version 1.11.34 and prior contains a Reflected Cross-Site Scripting (XSS) vulnerability in the session category listing page. The keyword parameter from $_REQUEST is echoed directly into an HTML href attribute without any encoding or sanitization. An attacker can inject arbitrary HTML/JavaScript by breaking out of the attribute context using ">followed by a malicious payload. The vulnerability is triggered when the pagination controls are rendered — which occurs when the number of session categories exceeds 20 (the page limit). This issue has been patched in version 1.11.36.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Chamilo LMS is a learning management system.CVE-2026-30881 · Other software · chamilo · reported by GitHubHigh 8.8
Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the statistics AJAX endpoint. The parameters date_start and date_end from $_REQUEST are embedded directly into a raw SQL string without proper sanitization. Although Database::escape_string() is called downstream, its output is immediately neutralized by str_replace("\'", "'", ...), which restores any injected single quotes — effectively bypassing the escaping mechanism entirely. This allows an authenticated attacker to inject arbitrary SQL statements into the database query, enabling blind time-based and conditional data extraction. This issue has been patched in version 1.11.36.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Chamilo LMS is a learning management system.CVE-2026-30876 · Other software · chamilo · reported by GitHubMedium 6.3
Chamilo LMS is a learning management system. Prior to version 1.11.36, Chamilo is vulnerable to user enumeration with valid/invalid username. This issue has been patched in version 1.11.36.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Chamilo LMS is a learning management system.CVE-2026-30875 · Other software · chamilo · reported by GitHubHigh 8.8
Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if h5p.json exists but doesn't block .htaccess or PHP files with alternative extensions. An attacker uploads a crafted H5P package containing a webshell and .htaccess that enables PHP execution for .txt files, bypassing security control. This issue has been patched in version 1.11.36.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Chamilo LMS is a learning management system.CVE-2026-28430 · Other software · chamilo · reported by GitHubCritical 9.3
Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to execute arbitrary SQL commands via the custom_dates parameter. By chaining this with a predictable legacy password reset mechanism, an attacker can achieve full administrative account takeover without any prior credentials. The vulnerability also exposes the entire database, including PII and system configurations. This issue has been patched in version 1.11.34.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was determined in Tiandy Integrated Management Platform 7.17.0.CVE-2026-4232 · Other software · Tiandy · reported by VulDBMedium 5.5
A vulnerability was determined in Tiandy Integrated Management Platform 7.17.0. Affected by this issue is some unknown functionality of the file /rest/user/getAuthorityByUserId. Executing a manipulation of the argument userId can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0.CVE-2026-4221 · Other software · Tiandy · reported by VulDBMedium 5.5
A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This affects an unknown part of the file /rest/file/uploadLedImage of the component Endpoint. The manipulation of the argument File results in unrestricted upload. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easy7 Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability has been found in Technologies Integrated Management Platform 7.17.0.CVE-2026-4220 · Other software · Technologies · reported by VulDBMedium 5.5
A vulnerability has been found in Technologies Integrated Management Platform 7.17.0. Affected by this issue is some unknown functionality of the file /SetWebpagePic.jsp. The manipulation of the argument targetPath/Suffix leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0.CVE-2026-4187 · Other software · Tiandy · reported by VulDBMedium 5.5
A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Impacted is an unknown function of the file /WebService/UpdateLocalDevInfo.jsp of the component Device Identifier Handler. Such manipulation of the argument username/password leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easy7 Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability has been found in Worksuite HR, CRM and Project Management up to 5.5.25.CVE-2026-4165 · Other software · Worksuite · reported by VulDBLow 1.9
A vulnerability has been found in Worksuite HR, CRM and Project Management up to 5.5.25. The affected element is an unknown function of the file /account/orders/create. The manipulation of the argument Client Note leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- HR, CRM and Project Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026SiYuan is a personal knowledge management system.CVE-2026-32704 · Other software · siyuan-note · reported by GitHubMedium 6.5
SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes. This vulnerability is fixed in 3.6.1.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents.CVE-2026-20991 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.7
Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Mar 16, 2026A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at lines 161-167.CVE-2025-14287 · Other software · mlflow · reported by security@huntr.devHigh 8.8
A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using `os.system()`. This allows attackers to execute arbitrary commands by supplying malicious input through the `--container` parameter of the CLI. The issue affects environments where MLflow is used, including development setups, CI/CD pipelines, and cloud deployments.
- Product
- mlflow/mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuntr.comaccess.redhat.com
Mar 16, 2026Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for interface management andCVE-2025-11500 · Other software · tinycontrol · reported by cvd@cert.plHigh 8.7
Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for interface management and one for protecting all other server resources. When the latter is turned off (which is a default setting), an unauthenticated attacker on the local network can obtain usernames and encoded passwords for interface management portal by inspecting the HTTP response of the server when visiting the login page, which contains a JSON file with these details. Both normal and admin users credentials are exposed. This issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).
- Product
- Lan Kontroler v3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026Statamic is a Laravel and Git powered content management system (CMS).CVE-2026-32612 · Other software · statamic · reported by GitHubMedium 5.4
Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account. This has been fixed in 6.6.2.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management fCVE-2026-22192 · Other software · Voltronic Power · reported by VulnCheckHigh 8.8
Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management functions by manipulating browser localStorage values. Attackers can modify client-side authentication state to bypass server-side access controls and gain unauthorized access to protected management functionality without valid credentials.
- Product
- SNMP Web Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvoltronicpower.com
Mar 13, 2026IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive information from the queCVE-2025-14811 · Other software · IBM · reported by psirt@us.ibm.comLow 3.1
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques.
- Product
- Sterling Partner Engagement Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information when dCVE-2025-13726 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks against the system.
- Product
- Sterling Partner Engagement Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using aCVE-2025-13723 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using an expired access token
- Product
- Sterling Partner Engagement Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information in cleCVE-2025-13718 · Other software · IBM · reported by psirt@us.ibm.comLow 3.7
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by unauthorized actors.
- Product
- Sterling Partner Engagement Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 is vulnerable to cross-site scripting.CVE-2025-13702 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- Sterling Partner Engagement Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration.CVE-2026-3611 · Other software · Honeywell · reported by ics-cert@hq.dhs.govCritical 10
The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.
- Product
- IQ4E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-32259 · Other software · ImageMagick · reported by GitHubMedium 6.7
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-16 and 6.9.13-41, when a memory allocation fails in the sixel encoder it would be possible to write past the end of a buffer on the stack. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026Tina is a headless content management system.CVE-2026-29066 · Other software · @tinacms · reported by GitHubMedium 6.2
Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.
- Product
- cli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026Tina is a headless content management system.CVE-2026-28793 · Other software · @tinacms · reported by GitHubHigh 8.4
Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, the CLI starts a local HTTP server (default port 4001) exposing endpoints such as /media/list/*, /media/upload/*, and /media/*. These endpoints process user-controlled path segments using decodeURI() and path.join() without validating that the resolved path remains within the configured media directory. This vulnerability is fixed in 2.1.8.
- Product
- cli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026Tina is a headless content management system.CVE-2026-28792 · Other software · @tinacms · reported by GitHubCritical 9.6
Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer's machines by simply tricking them into visiting a malicious website while tinacms dev is running. This vulnerability is fixed in 2.1.8.
- Product
- cli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.