Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,803 results · page 9 of 117
Sep 14, 2026Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long move is executed.CVE-2023-24285 · Other software · Simon Tatham · reported by MITRELow 2.9
Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long move is executed.
- Product
- Portable Puzzle Collection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggit.tartarus.org
Sep 13, 2026CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.CVE-2026-29812 · Other software · CyberPanel · reported by MITREMedium 4.3
CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.
- Product
- CyberPanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2026WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the like.json.php endpoint, allowing logged-inCVE-2026-90546 · Other software · WWBN · reported by VulnCheckMedium 5.3
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the like.json.php endpoint, allowing logged-in users to record likes on password-protected and group-restricted videos. Attackers can submit like requests for videos they cannot watch to increment like counters and bypass access controls.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 12, 2026WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders vCVE-2026-90542 · Other software · WWBN · reported by VulnCheckMedium 5.3
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the private schedule title from the generated email job.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 12, 2026Frontegg SAML SSO: Does not verify the signature or issuer of SAML authentication responses before establishing a sessionCVE-2026-75800 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.
- Product
- Frontegg SAML SSO
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Frontegg SAML SSO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on differCVE-2026-89746 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as named_data. Both are added to tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(), because save_hist_vars() is called before event_trigger_register() while the named reuse is only detected later, in hist_register_trigger(). In the named-data branch hist_register_trigger() then frees the second histogram's hist_data via destroy_hist_data(), but never removes its tr->hist_vars list entry, leaving a dangling pointer and leaking the trace_array reference it holds. A later hist trigger that references a variable makes find_var_file() walk tr->hist_vars and dereference the freed hist_data. The bug is reproducible from userspace by writing three hist triggers to tracefs: cd /sys/kernel/tracing echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 11, 2026In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGER_IOPF borrows an attacCVE-2026-89445 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.8
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from group->pasid_array without synchronizing against PASID detach, then a concurrent iommu_report_device_fault() can dereference that borrowed handle's domain pointer after the detach erases the handle and frees the backing struct iommufd_attach_handle. TRIGGER_IOPF then dereferences the freed handle, causing a UAF. Fix by adding a iopf_rwsem in mock_dev to follow the expected design of a real driver. Hold its read side across the whole iommu_report_device_fault() call, and its write side around every path that attaches, detaches, or replaces a device domain. This can block new reports and drains in-flight reports before an old attach handle or the IOPF fault parameter can be removed. Also take the write side while registering a mock device, since it can invoke the mock driver's default-domain attach callback.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 11, 2026AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.php, allowing logged-in users to submit CVE-2026-89251 · Other software · WWBN · reported by VulnCheckHigh 7.1
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests to mint YPTWallet balance for any campaign video without proof an ad actually played.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 11, 2026libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow.CVE-2026-89146 · Other software · libp2p · reported by VulnCheckHigh 8.7
libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer.
- Product
- libp2p-rendezvous
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rsgist.github.com
Sep 11, 2026morgan is an HTTP request logger middleware for Node.js.CVE-2026-87859 · Other software · morgan · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 5.3
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value written to a quoted field, such as the User-Agent or Referer header, can include a double quote to close that field early, so a log consumer that parses the log by field position reads attacker-supplied text as the following field. In the built-in formats this makes the recorded value differ from the value that was sent, and in custom formats that quote an attacker-controlled token before a server-controlled one it can forge values such as the response status. No newline is injected, so record separation stays intact. The issue is fixed in morgan 1.12.1, which escapes the double quote. Users should upgrade to morgan 1.12.1 or later.
- Product
- morgan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Sep 10, 2026zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinCVE-2026-89045 · Other software · luben · reported by VulnCheckMedium 5.1
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.
- Product
- zstd-jni
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.CVE-2026-85310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer.CVE-2026-87803 · Other software · Countly · reported by report@snyk.ioHigh 7.1
An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested array is a sub-pipeline by checking if every element contains a key present in a hardcoded KNOWN_STAGE_OPERATORS set. If any element contains an unrecognized stage key, such as the undocumented MongoDB-internal $_internalInhibitOptimization, the sanitizer misclassifies the entire branch as a generic array and skips stage-level stripping for all sibling stages. This allows a non-admin user with DBViewer read permission to inject forbidden operators like $lookup inside $facet sub-pipelines, performing cross-collection joins into restricted collections. This leads to unauthorized read access to sensitive data including password-reset tokens (prid), enabling account takeover.
- Product
- countly-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HCVE-2026-87928 · Other software · MaxSite · reported by VulnCheckMedium 5.1
MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/_pages/ directory, which executes in visitors' browsers when the file is accessed, enabling persistent stored cross-site scripting attacks.
- Product
- MaxSite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026In the Linux kernel, the following vulnerability has been resolved: vlan: fix skb_under_panic and races when toggling HW VLAN offload Toggling hardware VLAN TCVE-2026-80925 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: vlan: fix skb_under_panic and races when toggling HW VLAN offload Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(), which dynamically changed vlandev->hard_header_len. This causes two issues: 1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2) read dev->hard_header_len without holding RTNL lock. Mutating hard_header_len dynamically under RTNL creates a data race where upper layers reserve insufficient headroom based on a stale hard_header_len, resulting in skb_under_panic when vlan_dev_hard_header() is called. 2. In addition, vlan_transfer_features() updated hard_header_len without updating header_ops, causing a mismatch between allocated headroom and header creation. Always setting dev->hard_header_len = real_dev->hard_header_len and dev->needed_headroom = real_dev->needed_headroom + VLAN_HLEN unconditionally ensures: - dev->hard_header_len remains 100% static and immutable at real_dev->hard_header_len, eliminating all dynamic runtime updates and data races on hard_header_len. - Up
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 9, 2026PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animatiCVE-2026-86202 · Other software · pmmp · reported by VulnCheckMedium 5.3
PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.
- Product
- PocketMine-MP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory syncCVE-2023-54394 · Other software · pmmp · reported by VulnCheckMedium 5.3
PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data, consuming significant bandwidth without authentication.
- Product
- PocketMine-MP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan idenCVE-2026-87820 · Other software · usmannasir · reported by VulnCheckMedium 6.9
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.
- Product
- cyberpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Does not restrict the redirect target of its email preference confirmation flow to the site's own hostCVE-2026-81741 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafted link.
- Product
- Groundhogg — CRM, Newsletters, and Marketing Automation
- Fixed in
- 4.7.2
- What to do
- Update Groundhogg — CRM, Newsletters, and Marketing Automation to 4.7.2 or newer.
Sep 8, 2026In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion.CVE-2026-28617 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security featCVE-2026-81356 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Heap-based buffer overflow in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.CVE-2026-69495 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.CVE-2026-69494 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.CVE-2026-69493 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a network.CVE-2026-66816 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a network.
- Product
- Microsoft SQL Server 2022 (CU 26)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework.CVE-2026-82074 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.1
MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checksCVE-2026-82073 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.1
A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an internal command parameter that can be set by external clients, causing a security check to be improperly skipped.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially craftedCVE-2026-82068 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.1
A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentially propagating to additional nodes in a sharded cluster. Manual intervention is required to restore service availability.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internalCVE-2026-82059 · Other software · MongoDB · reported by cna@mongodb.comMedium 6
An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges could trigger an assertion failure in the index key generation code path. In certain build configurations, this assertion failure results in termination of the mongod process, causing a denial of service to all connected clients.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod).CVE-2026-82052 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.1
The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches.CVE-2026-86853 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 8, 2026A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized CVE-2026-86135 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3High 7
A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page.
- Product
- Dimension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.CVE-2026-79602 · Other software · Xen · reported by security@xen.orgHigh 8.8
A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.
- Product
- Xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxenbits.xenproject.orgopenwall.com
Sep 7, 2026SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a prCVE-2026-66767 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.7
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetchingCVE-2026-86503 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.3
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026A vulnerability was detected in ggml-org llama.cpp up to 0.4.0.CVE-2026-86317 · Other software · ggml-org · reported by VulDBMedium 6.9
A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpc_server::deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable assertion. The attack is possible to be carried out remotely. The reported GitHub issue was closed automatically due to inactivity.
- Product
- llama.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entriesCVE-2026-81738 · Other software · OpenVPN · reported by security@openvpn.netLow 2.3
OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries
- Product
- OpenVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescaCVE-2026-86118 · Other software · sentriz · reported by VulnCheckMedium 5.3
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.
- Product
- gonic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transport_header when sending VLAN-tagged frame In packet_parse_heaCVE-2026-80906 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transport_header when sending VLAN-tagged frame In packet_parse_headers(), when processing a VLAN-tagged frame, skb_set_network_header() is called to advance network_header past the VLAN tag to the inner protocol header. skb_probe_transport_header() is then called with skb->protocol still set to the outer VLAN EtherType (e.g. ETH_P_8021Q), while nhoff (derived from skb_network_offset()) already points past the VLAN tag to the inner protocol header. In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it reads a struct vlan_hdr at nhoff via __skb_header_pointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skb_probe_transport_header() never calls skb_set_transport_header(), leaving transport_header at its uninitialized sentinel value (~0U). Move skb_probe_transport_header() to before skb_set_network_header(). At the time skb_p
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 4, 2026In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transport_header when sending VLAN-tagged frame In tap_get_user_xdp(),CVE-2026-80905 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transport_header when sending VLAN-tagged frame In tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g. ETH_P_8021Q), skb_set_network_header() is called first to advance network_header past the VLAN tag to the inner protocol header. skb_probe_transport_header() is then called with skb->protocol still set to ETH_P_8021Q, while nhoff (derived from skb_network_offset()) already points past the VLAN tag to the inner protocol header. In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it reads a struct vlan_hdr at the current nhoff via __skb_header_pointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skb_probe_transport_header() never calls skb_set_transport_header(), leaving transport_header at its uninitialized sentinel value (~0U). Move skb_set_network_header() to after skb_probe_transport_header(). At the time skb_prob
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 4, 2026tokenizers (Hugging Face) is affected by an out-of-bounds buffer access in BpeBuilder::build (tokenizers/src/models/bpe/model.rs).CVE-2026-85670 · Other software · huggingface · reported by VulnCheckHigh 7.1
tokenizers (Hugging Face) is affected by an out-of-bounds buffer access in BpeBuilder::build (tokenizers/src/models/bpe/model.rs). When loading a tokenizer.json via Tokenizer::from_file/from_str, the builder sizes a scratch buffer to the longest vocabulary key, then writes each concatenated merge rule into it. A merge whose concatenated token exceeds the longest vocabulary key overruns the buffer, which Rust turns into a panic that aborts the process in Rust and FFI embeddings. This occurs at load time with no encoding required, so an attacker who supplies a crafted tokenizer.json can cause a denial of service. A secondary defect at the same location can cause a usize underflow (panic in debug, potential memory corruption in release) when continuing_subword_prefix is set and a merge token is shorter than the prefix. Observed in version 0.23.1.
- Product
- tokenizers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Marqo 2.26.0 contains a server-side request forgery vulnerability in the add_documents endpoint that allows unauthenticated attackers to trigger requests to arbCVE-2026-85662 · Other software · marqo-ai · reported by VulnCheckMedium 6.9
Marqo 2.26.0 contains a server-side request forgery vulnerability in the add_documents endpoint that allows unauthenticated attackers to trigger requests to arbitrary URLs by supplying malicious media field values. Attackers can exploit download_image_from_url and fetch_content_sample functions which lack destination filtering and host validation to access internal services and cloud metadata endpoints.
- Product
- marqo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs intCVE-2026-85651 · Other software · triggerdotdev · reported by VulnCheckHigh 8.4
Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim resources and pollute run history.
- Product
- trigger.dev
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRFCVE-2026-85650 · Other software · triggerdotdev · reported by VulnCheckMedium 5.3
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.
- Product
- trigger.dev
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's vCVE-2026-45197 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceLow 2.5
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised GPU memory. The firmware uses data provided by the Guest VM to set up accesses to memory. It validated this before use, but a TOCTOU bug was present which allowed the earlier check results to be invalidated.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four-byte packet triggers out-of-bounds memory access during desCVE-2026-85455 · Other software · themoos · reported by VulnCheckHigh 8.8
MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four-byte packet triggers out-of-bounds memory access during deserialization. Attackers can open a TCP connection to the MOOSDB port and send a crafted short packet to read memory before authentication.
- Product
- core-moos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers CVE-2026-85446 · Other software · moos-ivp · reported by VulnCheckHigh 8.7
MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic processing, delaying or preventing distribution of legitimate node reports.
- Product
- moos-ivp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unboCVE-2026-85442 · Other software · themoos · reported by VulnCheckHigh 8.7
MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory and cause denial of service before client authentication completes.
- Product
- core-moos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026A vulnerability was identified in langgenius dify 1.13.0.CVE-2026-85022 · Other software · langgenius · reported by VulDBLow 2
A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 3, 2026A vulnerability was determined in langgenius dify 1.13.0.CVE-2026-85021 · Other software · langgenius · reported by VulDBLow 2.1
A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirect_url causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.