Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,231 results · page 9 of 45
May 11, 2026`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hashCVE-2026-7210 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6.3
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs.CVE-2026-41705 · Other software · Spring · reported by security@vmware.comHigh 8.6
Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.x: affected from 1.0.0 through latest 1.0.x; upgrade to 1.0.7 or greater. Spring AI 1.1.x: affected from 1.1.0 through latest 1.1.x; upgrade to 1.1.6 or greater.
- Product
- Spring AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations.CVE-2026-44694 · Other software · czlonkowski · reported by GitHubHigh 7.2
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client (N8N_API_URL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. This issue has been patched in version 2.50.2.
- Product
- n8n-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations.CVE-2026-42282 · Other software · czlonkowski · reported by GitHubMedium 4.3
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.13, when n8n-mcp runs in HTTP transport mode, authenticated MCP tools/call requests had their full arguments and JSON-RPC params written to server logs by the request dispatcher and several sibling code paths before any redaction. When a tool call carries credential material — most notably n8n_manage_credentials.data — the raw values can be persisted in logs. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary (shared log storage, SIEM pipelines, support/ops access), this can result in disclosure of: bearer tokens and OAuth credentials sent through n8n_manage_credentials, per-tenant API keys and webhook auth headers embedded in tool arguments, arbitrary secret-bearing payloads passed to any MCP tool. The issue requires authentication (AUTH_TOKEN accepted by the server), so unauthenticated callers cannot trigger it; the runtime exposure is also reduced by an existing console-silencing layer in HTTP mode, but that layer is fragile and the values are still constructed and passed into
- Product
- n8n-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations.CVE-2026-41495 · Other software · czlonkowski · reported by GitHubMedium 5.3
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.11, when n8n-mcp runs in HTTP transport mode, incoming requests to the POST /mcp endpoint had their request metadata written to server logs regardless of the authentication outcome. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary (shared log storage, SIEM pipelines, support/ops access), this can result in disclosure of: bearer tokens from the Authorization header, per-tenant API keys from the, x-n8n-key header in multi-tenant setups, JSON-RPC request payloads sent to the MCP endpoint. Access control itself was not bypassed — unauthenticated requests were correctly rejected with 401 Unauthorized — but sensitive values from those rejected requests could still be persisted in logs. This issue has been patched in version 2.47.11.
- Product
- n8n-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026YARD is a Ruby Documentation tool.CVE-2026-41493 · Other software · lsegal · reported by GitHubMedium 6.9
YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.
- Product
- yard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations.CVE-2026-42449 · Other software · czlonkowski · reported by GitHubHigh 8.5
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. In versions 2.47.4 through 2.47.13, the SDK embedder path (N8NDocumentationMCPServer constructor, getN8nApiClient(), and validateInstanceContext()), the synchronous URL validator in SSRFProtection.validateUrlSync() had no IPv6 checks. IPv4-mapped IPv6 addresses such as http://[::ffff:169.254.169.254] bypassed the cloud-metadata, localhost, and private-IP range checks. An attacker able to supply an n8nApiUrl value could cause the server to issue HTTP requests to cloud metadata endpoints, RFC1918 private networks, or localhost services. Response bodies are returned to the caller (non-blind SSRF), and the n8nApiKey is forwarded in the x-n8n-api-key header to the attacker-controlled target. Projects with deployments embedding n8n-mcp as an SDK using N8NDocumentationMCPServer or N8NMCPEngine with user-supplied InstanceContext are affected. The first-party HTTP server deployment was not primarily affected — it has a second async validator (validateWebhookUrl) that catches IPv6 addresses. This issue has been fixed in version 2.47.14. If users are unable to upgrade immediately
- Product
- n8n-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters.CVE-2026-4430 · Other software · The Document Foundation · reported by security@documentfoundation.orgMedium 5.4
Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters. This issue affects LibreOffice: from 26.2 before 26.2.3, from 25.8 before 25.8.7.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026Gotenberg is an API-based document conversion tool.CVE-2026-39383 · Other software · gotenberg · reported by GitHubMedium 6.9
Gotenberg is an API-based document conversion tool. In version 8.29.1, an unauthenticated attacker with network access can force the server to make outbound HTTP POST requests to arbitrary internal or external destinations by supplying a crafted URL in the Gotenberg-Webhook-Url request header. The FilterDeadline function in filter.go is intended to gate outbound URLs, but when both the allow-list and deny-list are empty (the default configuration), it returns nil unconditionally and permits any URL. This is a blind SSRF: Gotenberg POSTs the converted document to the webhook URL and only checks whether the response status code is an error, but never returns the target's response body to the attacker. An attacker can use this to probe internal network infrastructure by observing whether the error callback is invoked, force POST requests against internal services that perform side effects, and confirm reachability of cloud metadata endpoints. The retryable HTTP client issues up to 4 automatic retries per request, amplifying each probe. This issue has been fixed in version 8.31.0. As a workaround, configure the GOTENBERG_API_WEBHOOK_ALLOW_LIST environment variable to restrict webhoo
- Product
- gotenberg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026Gotenberg is an API-based document conversion tool.CVE-2026-40280 · Other software · gotenberg · reported by GitHubHigh 7.8
Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression (^https?://) to match URL schemes. Because Go's net/url.Parse() normalizes the scheme to lowercase before establishing the outbound TCP connection, an attacker can bypass the deny-list by simply capitalizing part of the URL scheme (e.g., HTTP://, HTTPS://, or Http://). This allows unauthenticated requests to reach internal network services, including private IP ranges, loopback addresses, and cloud instance metadata endpoints such as HTTP://169.254.169.254/latest/meta-data/. This bypasses the same security control that was patched in CVE-2026-27018. This issue has been fixed in version 8.31.0.
- Product
- gotenberg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Improper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External Entities Blowup.CVE-2026-6501 · Other software · ILM Informatique · reported by 64c5ae8f-7972-4697-86a0-7ada793ac795Medium 5.3
Improper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External Entities Blowup. This issue affects jOpenDocument: 1.5.
- Product
- jOpenDocument
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytCVE-2026-23863 · Other software · Facebook · reported by cve-assign@fb.comMedium 6.5
An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of exploitation in the wild.
- Product
- WhatsApp Desktop for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacebook.comwhatsapp.com
Apr 29, 2026DocsGPT is a GPT-powered chat for documentation.CVE-2026-26015 · Other software · arc53 · reported by GitHubCritical 10
DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an attacker accessing both the official DocsGPT website or any local and public deployment, can craft a malicious payload bypassing the "MCP test" behavior to achieve arbitrary remote code execution (RCE). This issue has been patched in version 0.16.0.
- Product
- DocsGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026Outline is a service that allows for collaborative documentation.CVE-2026-41649 · Other software · outline · reported by GitHubHigh 7.7
Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, completely ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents belonging to other workspaces. The full document contents can then be retrieved via the `documents.info` endpoint. Version 1.7.0 contains a patch.
- Product
- outline
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorCVE-2026-6706 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs.CVE-2026-40978 · Other software · Spring · reported by security@vmware.comHigh 8.8
SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
- Product
- Spring AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution wheCVE-2026-5362 · Other software · pimcore · reported by help@fluidattacks.comMedium 4.8
An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered. This issue affects pimcore: v12.3.3.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Apr 27, 2026Document structural anomalies caused inconsistencies between page element relationships and internal index states.CVE-2026-5943 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered document modifications, object reference validity was not properly maintained, leading to a crash when accessing an invalid pointer during page information queries.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalidaCVE-2026-5942 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 5.5
Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalidated objects and crash the program.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of sCVE-2026-5938 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 5.5
Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2026Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability.CVE-2026-1952 · Other software · DeltaWW · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bCritical 9.8
Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability.
- Product
- AS320T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Apr 21, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-40927 · Other software · docmost · reported by GitHubMedium 5.4
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.0, when leaving a comment on a page, it is possible to include a JavaScript URI as the link. When a user clicks on the link the JavaScript executes. This vulnerability is fixed in 0.80.0.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2026An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escCVE-2026-30898 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Apr 16, 2026libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.CVE-2026-41080 · Other software · libexpat project · reported by MITRELow 2.9
libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
- Product
- libexpat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.hartwork.orggithub.com
Apr 16, 2026ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leadingCVE-2026-41034 · Other software · Ascensio · reported by MITREMedium 5
ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leading to an information leak and ASLR bypass.
- Product
- ONLYOFFICE DocumentServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead tCVE-2023-3634 · Other software · Festo · reported by info@cert.vde.comHigh 8.8
In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability.
- Product
- MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L4-AGD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comfesto.csaf-tp.certvde.com
Apr 15, 2026The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to CVE-2025-54550 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability. It does not affect Airflow release - example_dags are not supposed to be enabled in production environment, however users following the example could replicate the bad pattern. Documentation of Airflow 3.2.0 contains version of the example with improved resiliance for that case. Users who followed that pattern are advised to adjust their implementations accordingly.
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Apr 14, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-34213 · Other software · docmost · reported by GitHubMedium 5.4
Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same workspace by supplying a victim `attachmentId` to `POST /api/files/upload`. This is a remote integrity issue requiring no victim interaction. Version 0.71.0 contains a patch.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-34212 · Other software · docmost · reported by GitHubMedium 5.4
Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-33193 · Other software · docmost · reported by GitHubMedium 4.6
Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of MIME type spoofing (GHSL-2026-052). An attacker could exploit this flaw to inject malicious scripts, potentially compromising the security of users and data. Version 0.70.0 contains a patch.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-33146 · Other software · docmost · reported by GitHubMedium 4.3
Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-search`) for publicly shared content. This flaw allows unauthenticated users to enumerate and retrieve content that should remain hidden from public share viewers, leading to a confidentiality breach. Version 0.70.3 contains a patch.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload CVE-2026-39921 · Other software · GeoNode · reported by VulnCheckMedium 5.3
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malicious URL via the doc_url parameter during document upload. Attackers can supply URLs pointing to internal network targets, loopback addresses, RFC1918 addresses, or cloud metadata services to cause the server to make requests to internal resources without SSRF mitigations such as private IP filtering or redirect validation.
- Product
- GeoNode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console because document.write is used unsafelyCVE-2026-40212 · Other software · OpenStack · reported by MITREMedium 5.4
OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console because document.write is used unsafely, which is relevant in scenarios where administrators use the console web interface to view instance console logs.
- Product
- Skyline
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netreview.opendev.org
Apr 9, 2026Unhead is a document head and template manager.CVE-2026-39315 · Other software · unjs · reported by GitHubMedium 6.1
Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in <head> safely. Internally, the hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts decodes HTML entities before checking for blocked URI schemes (javascript:, data:, vbscript:). The decoder uses two regular expressions with fixed-width digit caps. The HTML5 specification imposes no limit on leading zeros in numeric character references. When a padded entity exceeds the regex digit cap, the decoder silently skips it. The undecoded string is then passed to startsWith('javascript:'), which does not match. makeTagSafe() writes the raw value directly into SSR HTML output. The browser's HTML parser decodes the padded entity natively and constructs the blocked URI. This vulnerability is fixed in 2.1.13.
- Product
- unhead
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026n8n-MCP is a Model Context Protocol (MCP) server that provides AI assistants with comprehensive access to n8n node documentation, properties, and operations.CVE-2026-39974 · Other software · czlonkowski · reported by GitHubHigh 8.5
n8n-MCP is a Model Context Protocol (MCP) server that provides AI assistants with comprehensive access to n8n node documentation, properties, and operations. Prior to 2.47.4, an authenticated Server-Side Request Forgery in n8n-mcp allows a caller holding a valid AUTH_TOKEN to cause the server to issue HTTP requests to arbitrary URLs supplied through multi-tenant HTTP headers. Response bodies are reflected back through JSON-RPC, so an attacker can read the contents of any URL the server can reach — including cloud instance metadata endpoints (AWS IMDS, GCP, Azure, Alibaba, Oracle), internal network services, and any other host the server process has network access to. The primary at-risk deployments are multi-tenant HTTP installations where more than one operator can present a valid AUTH_TOKEN, or where a token is shared with less-trusted clients. Single-tenant stdio deployments and HTTP deployments without multi-tenant headers are not affected. This vulnerability is fixed in 2.47.4.
- Product
- n8n-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Papra is a minimalistic document management and archiving platform.CVE-2026-35462 · Other software · papra-hq · reported by GitHubMedium 4.3
Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expired to continue accessing all protected endpoints as if the key were still valid. This vulnerability is fixed in 26.4.0.
- Product
- papra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Papra is a minimalistic document management and archiving platform.CVE-2026-35461 · Other software · papra-hq · reported by GitHubMedium 5
Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows authenticated users to register arbitrary URLs as webhook endpoints with no validation of the destination address. The server makes outbound HTTP POST requests to registered URLs, including localhost, internal network ranges, and cloud provider metadata endpoints, on every document event. This vulnerability is fixed in 26.4.0.
- Product
- papra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Papra is a minimalistic document management and archiving platform.CVE-2026-35460 · Other software · papra-hq · reported by GitHubMedium 4.3
Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, transactional email templates in Papra interpolate user.name directly into HTML without escaping or sanitization. An attacker who registers with a display name containing HTML tags will have those tags injected into the verification and password reset email bodies. Since emails are sent from the legitimate domain (e.g: auth@mail.papra.app), this enables convincing phishing attacks that appear to originate from official Papra notifications. This vulnerability is fixed in 26.4.0.
- Product
- papra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Gotenberg is an API for converting document formats.CVE-2026-35458 · Other software · gotenberg · reported by GitHubHigh 8.7
Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely.
- Product
- gotenberg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis.CVE-2026-34735 · Other software · HytaleModding · reported by GitHubHigh 8.7
The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. In version 1.2.0 and prior, the quickUpload() endpoint validates uploaded files by checking their MIME type (via PHP's finfo, which inspects file contents) but constructs the stored filename using the client-supplied file extension from getClientOriginalExtension(). These two checks are independent: an attacker can upload a file whose content passes the MIME allowlist while using a .php extension. The file is stored on the public disk and is directly accessible via URL, allowing server-side code execution. At time of publication no known patches exist.
- Product
- wiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unaCVE-2026-0932 · Other software · M-Files Corporation · reported by security@m-files.comMedium 6.9
Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attacker to cause the server to send HTTP GET requests to arbitrary URLs.
- Product
- M-Files Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordempower.m-files.comproduct.m-files.com
Mar 31, 2026The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state.CVE-2026-3777 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 5.5
The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifies the zoom property and then triggers a page change, the original view object may be destroyed while stale pointers are still kept and later dereferenced, which under crafted JavaScript and document structures can lead to a use-after-free condition and potentially allow arbitrary code execution.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form fields, annotations, or optional content groups (OCCVE-2026-3774 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 4.7
The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form fields, annotations, or optional content groups (OCGs) immediately before or after redaction, encryption, or printing. These script‑driven updates are not fully covered by the existing redaction, encryption, and printing logic, which, under specific document structures and user workflows, may cause a small amount of sensitive content to remain unremoved or unencrypted as expected, or result in printed output that slightly differs from what was reviewed on screen.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026XML Notepad is a Windows program that provides a simple intuitive User Interface for browsing and editing XML documents.CVE-2026-34401 · Computers, phones & browsers · microsoft · reported by GitHubMedium 6.5
XML Notepad is a Windows program that provides a simple intuitive User Interface for browsing and editing XML documents. Prior to version 2.9.0.21, XML Notepad does not disable DTD processing by default which means external entities are resolved automatically. There is a well known attack related to malicious DTD files where an attacker to craft a malicious XML file that loads a DTD that causes XML Notepad to make outbound HTTP/SMB requests, potentially leaking local file contents or capturing the victim's NTLM credentials. This issue has been patched in version 2.9.0.21.
- Product
- XmlNotepad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import processCVE-2026-30276 · Other software · Deftpdf · reported by MITRECritical 9.8
An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
- Product
- Document Translator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x throCVE-2025-10551 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Gotenberg is an API for converting document formats.CVE-2026-27018 · Other software · gotenberg · reported by GitHubHigh 7.8
Gotenberg is an API for converting document formats. Prior to version 8.29.0, the fix introduced for CVE-2024-21527 can be bypassed using mixed-case or uppercase URL schemes. This issue has been patched in version 8.29.0.
- Product
- gotenberg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Outline is a service that allows for collaborative documentation.CVE-2026-33640 · Other software · outline · reported by GitHubCritical 9.1
Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users not associated with an Identity Provider. Starting in version 0.86.0 and prior to version 1.6.0, Outline does not invalidate OTP codes based on amount or frequency of invalid submissions, rather it relies on the rate limiter to restrict attempts. Consequently, identified bypasses in the rate limiter permit unrestricted OTP code submissions within the codes lifetime. This allows attackers to perform brute force attacks which enable account takeover. Version 1.6.0 fixes the issue.
- Product
- outline
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026A security issue was discovered in the Feast Feature Server's `/read-document` endpoint that allows an unauthenticated remote attacker to read any file accessibCVE-2026-23536 · Other software · Red Hat · reported by Red HatHigh 7.5
A security issue was discovered in the Feast Feature Server's `/read-document` endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to potentially retrieve sensitive system files, application configurations, and credentials.
- Product
- Red Hat OpenShift AI (RHOAI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Mar 20, 2026SyncFusion 30.1.37 is vulnerable to Cross Site Scripting (XSS) via the Document-Editor reply to comment field and Chat-UI Chat message.CVE-2025-63260 · Other software · Syncfusion · reported by MITREMedium 5.4
SyncFusion 30.1.37 is vulnerable to Cross Site Scripting (XSS) via the Document-Editor reply to comment field and Chat-UI Chat message.
- Product
- Syncfusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.