Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,891 results · page 9 of 118
Oct 13, 2026Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2026-102187 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.CVE-2026-102186 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the datCVE-2026-93294 · Other software · Grafana · reported by security@grafana.comMedium 6.3
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
- Product
- Grafana Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.CVE-2026-109412 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Critical 9.9
An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.
- Product
- Neurons Patch for Intune
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose CVE-2026-106035 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Medium 5.5
An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log.
- Product
- Xtraction
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts aCVE-2026-109942 · Other software · FreeRDP · reported by VulnCheckHigh 7.1
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-byte CLOSE_CHANNEL header to crash a connecting FreeRDP client.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA CVE-2026-109678 · Other software · FreeRDP · reported by VulnCheckHigh 7.1
FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination to scard_copy_strings. A malicious RDP server can send an SCardStatusA request with fmszReaderNamesIsNULL=1 to abort a connecting client.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026NVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors component, where the gRPC health-event interface, exposed over a world-writable CVE-2026-65131 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6
NVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors component, where the gRPC health-event interface, exposed over a world-writable Unix domain socket, lacks authentication. A successful exploit of this vulnerability might lead to denial of service.
- Product
- NVSentinel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Oct 13, 2026A vulnerability was detected in MosaicML Composer up to 0.32.1.CVE-2026-109153 · Other software · MosaicML · reported by VulDBMedium 5.3
A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.
- Product
- Composer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality.CVE-2026-89110 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.9
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.
- Product
- SAP NetWeaver Visual Composer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet.CVE-2026-87689 · Other software · Rapid7 · reported by cve@rapid7.comCritical 9.8
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.
- Product
- Metasploit Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via CVE-2026-109596 · Other software · gohugoio · reported by VulnCheckMedium 6.7
Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.
- Product
- hugo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelistedCVE-2023-54411 · Other software · frappe · reported by VulnCheckHigh 8.2
Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because peCVE-2026-109561 · Other software · aaif-goose · reported by VulnCheckLow 2.3
goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.
- Product
- goose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the stCVE-2026-109425 · Other software · tink-crypto · reported by VulnCheckMedium 6.9
Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset invariants to be accepted. Attackers can supply a malformed keyset, such as one with an enabled public key lacking a valid primary key or a DESTROYED key with no KeyData, causing inconsistent downstream validation where functions like jwt.JWKSetFromPublicKeysetHandle() process the invalid handle and produce a JWK set, potentially misleading applications that rely on successful handle construction as proof of keyset integrity.
- Product
- tink-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted CVE-2026-109298 · Other software · open-webui · reported by VulnCheckHigh 7.1
Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rCVE-2026-109297 · Other software · open-webui · reported by VulnCheckHigh 7.1
Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes unCVE-2026-109269 · Other software · ImageMagick · reported by VulnCheckMedium 6.9
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for processing to disclose uninitialized memory contents.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents.CVE-2026-109259 · Other software · ImageMagick · reported by VulnCheckMedium 6.9
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args stCVE-2026-108857 · Other software · Hugging Face · reported by VulnCheckMedium 4.8
Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args struct lacks a redact attribute for it. Attackers with access to router logs, container output, or OTLP telemetry can recover the Bearer token and call the protected embedding and rerank endpoints.
- Product
- Text Embeddings Inference
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query stringCVE-2026-108754 · Other software · tbphp · reported by VulnCheckMedium 4.8
GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.
- Product
- gpt-load
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWCVE-2026-108753 · Other software · agnaistic · reported by VulnCheckCritical 9.3
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.
- Product
- agnai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download prCVE-2026-108729 · Other software · cortezaproject · reported by VulnCheckHigh 8.2
Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment id can request the original or preview route without a token or signature to retrieve files across namespace and record permission boundaries.
- Product
- corteza
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Quick quotes: Does not perform any capability or nonce check on one of its AJAX actions and lets the caller chooseCVE-2026-86706 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.
- Product
- Quick quotes
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Quick quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026SMS Alert: Does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password resetCVE-2026-94257 · WordPress plugins & themes · reported by WPScanHigh 8.1
The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.
- Product
- SMS Alert
- Fixed in
- 4.0.1
- What to do
- Update SMS Alert to 4.0.1 or newer.
Oct 9, 2026In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functionsCVE-2026-108474 · Other software · JetBrains · reported by cve@jetbrains.comCritical 9.8
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
- Product
- Exposed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP.CVE-2026-107824 · Other software · duty1g · reported by GitHubCritical 9.3
x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated network client that can reach the default port, 9094 for x64 or 9095 for x32, can execute arbitrary x64dbg commands, attach to processes by PID, read and write debuggee memory, and write files to arbitrary paths. This issue is fixed in version 1.1.
- Product
- x64dbg-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP.CVE-2026-107820 · Other software · duty1g · reported by GitHubMedium 5.3
x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcp_server.zig parses an unbounded Content-Length value in parseContentLength() and uses it in unchecked usize addition in wsRecv() before token authentication. The server listens on 0.0.0.0 by default in affected versions. An unauthenticated network client can supply a near-maximum Content-Length value to trigger a runtime integer-overflow panic in Debug and ReleaseSafe builds, terminating the entire x64dbg process and its live debugging session. The overflowed value is used only in a comparison, so the impact is limited to denial of service rather than memory corruption or code execution. This issue is fixed in version 1.2.
- Product
- x64dbg-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows.CVE-2026-108111 · Other software · ageerle · reported by VulnCheckMedium 5.3
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or is_public filtering, to list enabled private workflows in the same tenant, including UUIDs and full node and edge configurations.
- Product
- ruoyi-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026FiboSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Reflected XSS.This issue affects FiboSearch: from n/a through 1.34.1.
- Product
- FiboSearch
- Affected
- up to 1.34.1
- What to do
- Affects up to 1.34.1. Update FiboSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to coCVE-2026-94444 · Other software · Go toolchain · reported by security@golang.orgHigh 7.8
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.CVE-2026-83943 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.7
Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.
- Product
- Azure API Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures.CVE-2026-107375 · Other software · jhipster · reported by GitHubHigh 8.8
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request parameter from paginated entity-list endpoints into createOrderByFields in generators/spring-boot/generators/data-relational/templates/src/main/java/package/repository/EntityManager_reactive.java.ejs. The generated code renders these properties into the SQL ORDER BY clause without validation or quoting, and the R2DBC simple query protocol can execute additional statements separated by semicolons. A normal authenticated user can consequently read sensitive tables, modify or delete data, or drop tables, while non-reactive JPA applications and NoSQL backends are outside this root cause. This issue is fixed in 9.4.0.
- Product
- generator-jhipster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)).CVE-2026-107337 · Other software · CISA · reported by ics-cert@hq.dhs.govHigh 7.1
The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.
- Product
- Malcolm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures.CVE-2026-107303 · Other software · jhipster · reported by GitHubHigh 7.6
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return them through generated REST endpoints, and pass them to the generated openFile helper in generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs. The helper uses the returned ContentType as the browser Blob MIME type and opens an object URL, so a normal authenticated user with write access to a Blob-bearing entity can store active HTML or SVG content that may execute under the application origin when a privileged user opens it. Exploitability depends on the generated application's content security policy and target-browser Blob behavior. This issue is fixed in generator-jhipster 9.4.0 and react-jhipster 1.1.0.
- Product
- generator-jhipster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Visual Composer Website Builder: Missing AuthorizationCVE-2026-106596 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Composer Website Builder: from n/a through 45.16.3.
- Product
- Visual Composer Website Builder
- Affected
- up to 45.16.3
- What to do
- Affects up to 45.16.3. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contaiCVE-2026-104704 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 7.4
Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published, so delivery to such a host fell back to opportunistic TLS. An attacker with an active position on the network path between the server and the recipient's mail exchanger can suppress or break the STARTTLS negotiation and cause messages to be delivered in cleartext, where they can be read and modified.
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Frontend Dashboard: Does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request dataCVE-2026-103692 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.
- Product
- Frontend Dashboard
- Fixed in
- 3.0.5
- What to do
- Update Frontend Dashboard to 3.0.5 or newer.
Oct 6, 2026In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerabilCVE-2026-106586 · Other software · OpenBSD · reported by MITRELow 2.5
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, givingCVE-2026-95112 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Medium 6.5
When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of about 1 MB that keeps a CPU core busy for several minutes while holding a database transaction open.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 6, 2026Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced dCVE-2026-103007 · Other software · Elastic · reported by security@elastic.coHigh 7.2
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that should remain restricted, including internal security data. This can enable further escalation up to full administrative control of the cluster.
- Product
- Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobCVE-2026-106513 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 6.9
MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional validation. An attacker who obtains a hijacked site-admin session (for example, through a stored cross-site scripting vulnerability) can modify the Redis host settings to point at an attacker-controlled Redis server and then restart the workers. Once the workers connect to the attacker's Redis instance, the attacker can inject malicious job payloads that the workers execute, achieving arbitrary command execution as the worker account. Additionally, the download_attachments_on_load setting, which controls inline attachment rendering, was modifiable through the same interface, allowing a hijacked session to re-enable a feature that could facilitate further client-side attacks. The vulnerability requires site-admin privileges and a prior session-compromise mechanism; it does not require unauthenticated access. The impact is remote code execution in the context of the MISP worker process and potenti
- Product
- MISP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust.CVE-2026-105794 · Computers, phones & browsers · microsoft · reported by GitHubCritical 9.1
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.
- Product
- msquic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose dCVE-2026-98358 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iser_reg_mem_fastreg() takes the DMA key path and leaves rdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has already set dir[ISER_DIR_OUT]. iser_check_remote_inv() looks at dir[] alone and hands the descriptor to iser_inv_desc(), which reads desc->sig_protected. A target that answers such a command with IB_WR_SEND_WITH_INV faults the initiator. Leaving those commands unregistered is deliberate. The same function already terminates the connection when a target sends a remote invalidation the initiator did not ask for. A target that invalidates a direction that was never registered is in the same class, so give it the same answer. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy) Hardware name: QEM
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 6, 2026In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().CVE-2026-98300 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). tcp_v6_do_rcv() no longer calls skb_clone_and_charge_r() for TCP_LISTEN since commit 073d89808c06 ("net: fix data-races around sk->sk_forward_alloc"). However, there is still a small race window between tcp_v6_rcv() and tcp_v6_do_rcv(), where concurrent close() changes TCP_LISTEN to TCP_CLOSE, causing skb_clone_and_charge_r() to be called locklessly and resulting in the splat below. [0] Let's avoid calling skb_clone_and_charge_r() for TCP_CLOSE as well. This is fine for non-listeners because tcp_rcv_state_process() drops skb for TCP_CLOSE and opt_skb was freed immediately anyway. [0]: sk->sk_forward_alloc WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162, CPU#1: ksoftirqd/1/28 Modules linked in: CPU: 1 UID: 0 PID: 28 Comm: ksoftirqd/1 Not tainted 7.2.0 #17 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162 Code: 3d 49 ff e9 06 fd ff ff e8 d0 5b 83 f8 90 0f 0b 90 e9 35 fe ff
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 6, 2026In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Do not write to the serial port after it is closed hci_uart_close() clCVE-2026-98294 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Do not write to the serial port after it is closed hci_uart_close() closes the serdev port if HCI_QUIRK_NON_PERSISTENT_SETUP is set (for example, for the WCN399x family). A failed hci_dev_open_sync() following a successful qca_setup() calls hdev->close() but not hdev->shutdown(), so the port is closed while power->vregs_on is left true. qca_serdev_remove() then passes its power->vregs_on test and calls qca_power_off(), which writes to the closed port unconditionally. Seen on a WCN3988 by unbinding the driver after a controller failure. The trace below is from a 7.0.0 based kernel, where qca_power_off() was still named qca_power_shutdown(): Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 Call trace: tty_set_termios+0x50/0x238 (P) ttyport_set_baudrate+0x84/0xc0 serdev_device_set_baudrate+0x24/0x40 qca_power_shutdown+0x158/0x1fc [hci_uart] qca_serdev_remove+0x54/0x68 [hci_uart] serdev_drv_remove+0x1c/0x2c device_remove+0x4c/0x80 device_release_driver_internal+0x1cc/0x224 device_driver_detach+0x18/0x24 unbind_store+0xb4/0xc
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 6, 2026In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Serialize local codec list cleanup hci_dev_close_sync() clears hdev->CVE-2026-98246 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Serialize local codec list cleanup hci_dev_close_sync() clears hdev->local_codecs after releasing hdev->lock. Codec list additions and both traversals in sco_sock_getsockopt() use that lock, but the close path does not. A close and BT_CODEC query can therefore interleave as follows: hci_dev_close_sync() sco_sock_getsockopt() hci_dev_lock() fetch codec entry hci_codec_list_clear() kfree(entry) read entry->id The reader then accesses an entry which the close path has freed. KASAN BUG: KASAN: slab-use-after-free in sco_sock_getsockopt+0xfa0/0xfe0 Read of size 1 at addr ffff8881001c3450 Call Trace: sco_sock_getsockopt+0xfa0/0xfe0 do_sock_getsockopt+0x537/0x7b0 __sys_getsockopt+0xf2/0x170 Allocated by task 92: hci_codec_list_add.isra.0+0x2c/0x440 hci_read_codec_capabilities+0x224/0x590 hci_read_supported_codecs+0x2c2/0x640 Freed by task 92: kfree+0x131/0x3c0 hci_codec_list_clear+0xd8/0x160 hci_dev_close_sync+0x92a/0xfa0 Take hdev->lock around the
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 6, 2026In the Linux kernel, the following vulnerability has been resolved: sched_ext: Close the pre-enable ops error claim window scx_alloc_and_add_sched() publishesCVE-2026-98219 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Close the pre-enable ops error claim window scx_alloc_and_add_sched() publishes ops->priv before scx_root_enable_workfn() switches the state to SCX_ENABLING. An error claimed via scx_bpf_error_bstr() from an associated BPF program in that window is consumed by scx_disable_workfn(), which takes the pre-enable shortcut in scx_root_disable(). The shortcut returns without any teardown and restores SCX_DISABLED with an unconditional scx_set_enable_state() xchg racing the enable workfn's own transition. The enable then completes with the claim consumed: the scheduler stays up but can never be disabled again, and bpf_scx_unreg() frees it while still in use, resulting in a use-after-free. Both WARN_ON_ONCE()s fire back to back: WARNING: kernel/sched/ext/ext.c:7522 at scx_root_enable_workfn+0xeec/0x1be0, CPU#3: scx_enable_help/276 WARNING: kernel/sched/ext/ext.c:6398 at scx_root_disable+0xb50/0xdb8, CPU#0: sched_ext_helpe/664 scx_root_enable_workfn() switches to SCX_ENABLING before the scheduler allocation, so ops->priv is never visible while SCX_DISABLED. The allocation failure path restores SCX_DIS
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 6, 2026An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.CVE-2026-94293 · Other software · Murrelektronik · reported by info@cert.vde.comCritical 9.3
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
- Product
- Software AAS Edge Client all versions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input inCVE-2026-82989 · Other software · Viewsonic · reported by cret@cert.orgCritical 9.8
There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints
- Product
- vCast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.l3afs.spacekb.cert.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.