Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,315 results · page 90 of 347
Feb 11, 2026Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal.CVE-2026-25999 · Other software · Aiven-Open · reported by GitHubHigh 7.1
Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to 2.10.2, there is an improper access control vulnerability that allows unauthorized users to trigger a reset or deletion of metadata for any tenant. By sending a crafted request to the /resetMemoryCache endpoint, an attacker can clear cached configurations, environments, and cluster data. This vulnerability is fixed in 2.10.2.
- Product
- klaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Kanboard is project management software focused on Kanban methodology.CVE-2026-25924 · Other software · kanboard · reported by GitHubHigh 8.4
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application correctly hides the plugin installation interface when the PLUGIN_INSTALLER configuration is set to false, the underlying backend endpoint fails to verify this security setting. An attacker can exploit this oversight to force the server to download and install a malicious plugin, leading to arbitrary code execution. This vulnerability is fixed in 1.2.50.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Statmatic is a Laravel and Git powered content management system (CMS).CVE-2026-25759 · Other software · statamic · reported by GitHubHigh 8.7
Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This vulnerability can be exploited to allow super admin accounts to be created. This has been fixed in 6.2.3.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026ASTPP 4.0.1 contains multiple vulnerabilities including cross-site scripting and command injection in SIP device configuration and plugin management interfaces.CVE-2020-37153 · Other software · ASTPP · reported by VulnCheckHigh 7.7
ASTPP 4.0.1 contains multiple vulnerabilities including cross-site scripting and command injection in SIP device configuration and plugin management interfaces. Attackers can exploit these flaws to inject system commands, hijack administrator sessions, and potentially execute arbitrary code with root permissions through cron task manipulation.
- Product
- ASTPP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comastppbilling.org
Feb 11, 2026A missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unauthenticated attackers oCVE-2025-65128 · Other software · reported by MITREHigh 8.1
A missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unauthenticated attackers on the local network to modify router and network configurations. By invoking operations whose names end with "*_nocommit" and supplying the parameters expected by the invoked function, an attacker can change configuration data, including SSID, Wi-Fi credentials, and administrative passwords, without authentication or an existing session.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Improper input validation in system management mode (SMM) could allow a privileged attacker to overwrite stack memory leading to arbitrary code execution.CVE-2025-29950 · Other software · AMD · reported by psirt@amd.comHigh 7.1
Improper input validation in system management mode (SMM) could allow a privileged attacker to overwrite stack memory leading to arbitrary code execution.
- Product
- AMD EPYC™ 9004 Series Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Improper handling of overlap between the segmented reverse map table (RMP) and system management mode (SMM) memory could allow a privileged attacker corrupt or CVE-2025-0012 · Other software · AMD · reported by psirt@amd.comMedium 6.8
Improper handling of overlap between the segmented reverse map table (RMP) and system management mode (SMM) memory could allow a privileged attacker corrupt or partially infer SMM memory resulting in loss of integrity or confidentiality.
- Product
- AMD EPYC™ 9005 Series Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026SiYuan is a personal knowledge management system.CVE-2026-25992 · Other software · siyuan-note · reported by GitHubHigh 7.5
SiYuan is a personal knowledge management system. Prior to 3.5.5, the /api/file/getFile endpoint uses case-sensitive string equality checks to block access to sensitive files. On case-insensitive file systems such as Windows, attackers can bypass restrictions using mixed-case paths and read protected configuration files. This vulnerability is fixed in 3.5.5.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Worklenz is a project management tool.CVE-2026-25947 · Other software · Worklenz · reported by GitHubHigh 8.8
Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.
- Product
- worklenz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Microsoft Windows Improper Privilege Management VulnerabilityCVE-2026-21533 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.
- Product
- Windows
- On CISA’s list since
- Feb 10, 2026 (federal fix deadline Mar 3, 2026)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comvicarius.io
Feb 10, 2026Kanboard is project management software focused on Kanban methodology.CVE-2026-25530 · Other software · kanboard · reported by GitHubMedium 4.3
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Kanboard is project management software focused on Kanban methodology.CVE-2026-24885 · Other software · kanboard · reported by GitHubMedium 5.7
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the ProjectPermissionController within the Kanboard application. The application fails to strictly enforce the application/json Content-Type for the changeUserRole action. Although the request body is JSON, the server accepts text/plain, allowing an attacker to craft a malicious form using the text/plain attribute. Which allows unauthorized modification of project user roles if an authenticated admin visits a malicious site This vulnerability is fixed in 1.2.50.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Out-of-bounds read in the firmware for some Intel(R) Converged Security and Management Engine (CSME) Firmware (FW) within Ring 0: Kernel may allow an informatioCVE-2025-27708 · Other software · reported by secure@intel.comMedium 5.6
Out-of-bounds read in the firmware for some Intel(R) Converged Security and Management Engine (CSME) Firmware (FW) within Ring 0: Kernel may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Incorrect default permissions for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_01.00.00.3584, CR_MGMT_02.00.00.4052, CR_MGMT_03.00.0CVE-2025-22849 · Other software · reported by secure@intel.comMedium 5.4
Incorrect default permissions for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_01.00.00.3584, CR_MGMT_02.00.00.4052, CR_MGMT_03.00.00.0538 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Improper conditions check for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_02.00.00.4052, CR_MGMT_03.00.00.0538 within Ring 3: User CVE-2025-20070 · Other software · reported by secure@intel.comMedium 5.4
Improper conditions check for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_02.00.00.4052, CR_MGMT_03.00.00.0538 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable [cvss_threat_loss_factor]. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3), User Management Component (UMC) (All versions < V2.15.2.1).CVE-2026-25656 · Other software · Siemens · reported by productcert@siemens.comHigh 8.5
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3), User Management Component (UMC) (All versions < V2.15.2.1). The affected application permits improper modification of a configuration file by a low-privileged user. This could allow an attacker to load malicious DLLs, potentially leading to arbitrary code execution with SYSTEM privileges.(ZDI-CAN-28108)
- Product
- SINEC NMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Feb 9, 2026Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated attacker could access CVE-2026-24327 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This leads to low impact on confidentiality and no effect on integrity or availability.
- Product
- SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability.CVE-2026-24325 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.8
SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.This vulnerability has low impact on confidentiality and integrity of the data. There is no impact on the availability of the application.
- Product
- SAP BusinessObjects Enterprise (Central Management Console)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized.CVE-2026-24323 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. When a victim accesses a crafted URL, the injected script is executed in the victim�s browser, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.
- Product
- SAP Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memoryCVE-2026-24320 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.1
Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory corruption and the potential leakage of memory content. Successful exploitation of this vulnerability would have a low impact on the confidentiality of the application, with no effect on its integrity or availability.
- Product
- SAP NetWeaver and ABAP Platform (Application Server ABAP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repCVE-2026-23689 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.7
Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.
- Product
- SAP Supply Chain Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated.CVE-2026-0505 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.
- Product
- SAP Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crCVE-2026-0485 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.5
SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, rendering the CMS completely unavailable. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.
- Product
- SAP BusinessObjects BI Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Adminer is open-source database management software.CVE-2026-25892 · Other software · vrana · reported by GitHubHigh 7.5
Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, openssl_verify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users. Upgrade to Adminer 5.4.2.
- Product
- adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25875 · Other software · Praskla-Technology · reported by GitHubCritical 9.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The admin authorization middleware trusts client-controlled JWT claims (role and scope) without enforcing server-side role verification.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25814 · Other software · Praskla-Technology · reported by GitHubCritical 9.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query parameters are passed directly into DynamoDB query/filter construction without validation or sanitization.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25813 · Other software · Praskla-Technology · reported by GitHubHigh 8.7
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data directly to console output without masking or redaction.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25812 · Other software · Praskla-Technology · reported by GitHubCritical 9.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application enables credentialed CORS requests but does not implement any CSRF protection mechanism.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25811 · Other software · Praskla-Technology · reported by GitHubMedium 5.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from the email domain provided by the user, without validating domain ownership or registration. This allows cross-tenant data access.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25876 · Other software · Praskla-Technology · reported by GitHubMedium 5.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/results.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks). For example, this can be used to return all results for an assessment.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25810 · Other software · Praskla-Technology · reported by GitHubMedium 5.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/student.submission.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks).
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25809 · Other software · Praskla-Technology · reported by GitHubMedium 5.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has started, is not expired, or the submission window is currently open.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25806 · Other software · Praskla-Technology · reported by GitHubMedium 5.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email PUT /api/students/:email/status, and DELETE /api/students/:email routes in backend/src/routes/student.routes.ts only enforce authentication using authenticateToken but do not enforce authorization. The application does not verify whether the authenticated user owns the student record being accessed, has an administrative / staff role, or is permitted to modify or delete the target student.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Craft CMS is a content management system.CVE-2026-25492 · Other software · craftcms · reported by GitHubMedium 5.3
Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save_images_Asset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a non-image file extension such as .txt is allowed, downstream image validation is bypassed, which can allow an authenticated attacker with permission to use save_images_Asset to retrieve sensitive data such as AWS instance metadata credentials from the underlying host. This issue is patched in versions 4.16.18 and 5.8.22.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026OpenProject is an open-source, web-based project management software.CVE-2026-24777 · Other software · opf · reported by GitHubMedium 6.7
OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permission can lock and unlock users. This functionality should only be possible for users of the application, but they were not supposed to be able to lock application administrators. Due to a missing permission check this logic was not enforced. The problem was fixed in OpenProject 17.0.2The problem was fixed in OpenProject 17.0.2.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026eLection 2.0 contains an authenticated SQL injection vulnerability in the candidate management endpoint that allows attackers to manipulate database queries thrCVE-2020-37154 · Other software · Tripath Project · reported by VulnCheckHigh 7.1
eLection 2.0 contains an authenticated SQL injection vulnerability in the candidate management endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can leverage SQLMap to exploit the vulnerability, potentially gaining remote code execution by uploading backdoor files to the web application directory.
- Product
- eLection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Feb 6, 2026OpenProject is an open-source, web-based project management software.CVE-2026-25764 · Other software · opf · reported by GitHubLow 3.5
OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injection vulnerability occurs in the time tracking function of OpenProject. The application does not escape HTML tags, an attacker with administrator privileges can create a work package with the name containing the HTML tags and add it to the Work package section when creating time tracking. This issue has been patched in versions 16.6.7 and 17.0.3.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026OpenProject is an open-source, web-based project management software.CVE-2026-25763 · Other software · opf · reported by GitHubCritical 9.4
OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an arbitrary file write vulnerability exists in OpenProject’s repository changes endpoint (/projects/:project_id/repository/changes) when rendering the “latest changes” view via git log. By supplying a specially crafted rev value (for example, rev=--output=/tmp/poc.txt), an attacker can inject git log command-line options. When OpenProject executes the SCM command, Git interprets the attacker-controlled rev as an option and writes the output to an attacker-chosen path. As a result, any user with the :browse_repository permission on the project can create or overwrite arbitrary files that the OpenProject process user is permitted to write. The written contents consist of git log output, but by crafting custom commits the attacker can still upload valid shell scripts, ultimately leading to RCE. The RCE lets the attacker create a reverse shell to the target host and view confidential files outside of OpenProject, such as /etc/passwd. This issue has been patched in versions 16.6.7 and 17.0.3.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Payload is a free and open source headless content management system.CVE-2026-25574 · Other software · payloadcms · reported by GitHubMedium 5.4
Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide. This vulnerability has been patched in v3.74.0.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Payload is a free and open source headless content management system.CVE-2026-25544 · Other software · payloadcms · reported by GitHubCritical 9.8
Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking. This vulnerability is fixed in 3.73.0.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026The Agentspace service was affected by a vulnerability that exposed sensitive information due to the use of predictable Google Cloud Storage bucket names.CVE-2026-1727 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cCritical 9.1
The Agentspace service was affected by a vulnerability that exposed sensitive information due to the use of predictable Google Cloud Storage bucket names. These names were utilized for error logs and temporary staging during data imports from GCS and Cloud SQL. This predictability allowed an attacker to engage in "bucket squatting" by establishing these buckets before a victim's initial use. All versions after December 12th, 2025 have been updated to protect from this vulnerability. No user action is required for this.
- Product
- Gemini Enterprise (formerly Agentspace)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-25634 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to 2.3.1.4, SrcPixel and DestPixel stack buffers overlap in CIccTagMultiProcessElement::Apply() int IccTagMPE.cpp. This vulnerability is fixed in 2.3.1.4.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.CVE-2026-22254 · Other software · wintercms · reported by GitHubNone
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10.
- Product
- winter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25753 · Other software · Praskla-Technology · reported by GitHubCritical 9.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application uses a hard-coded, static default password for all newly created student accounts. This results in mass account takeover, allowing any attacker to log in as any student once the password is known.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026OpenSTAManager is an open source management software for technical assistance and invoicing.CVE-2026-24418 · Other software · devcode-it · reported by GitHubHigh 8.7
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based SQL Injection vulnerability in the bulk operations handler for the Scadenzario (Payment Schedule) module. The application fails to validate that elements of the id_records array are integers before using them in an SQL IN() clause, allowing attackers to inject arbitrary SQL commands and extract sensitive data through XPATH error messages.
- Product
- openstamanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026OpenSTAManager is an open source management software for technical assistance and invoicing.CVE-2026-24417 · Other software · devcode-it · reported by GitHubHigh 8.7
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Blind SQL Injection vulnerability in the global search functionality. The application fails to properly sanitize the term parameter before using it in SQL LIKE clauses across multiple module-specific search handlers, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference.
- Product
- openstamanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026OpenSTAManager is an open source management software for technical assistance and invoicing.CVE-2026-24416 · Other software · devcode-it · reported by GitHubHigh 8.7
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Blind SQL Injection vulnerability in the article pricing completion handler. The application fails to properly sanitize the idarticolo parameter before using it in SQL queries, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference.
- Product
- openstamanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026OpenSTAManager is an open source management software for technical assistance and invoicing.CVE-2025-69216 · Other software · devcode-it · reported by GitHubHigh 8.7
OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an authenticated SQL injection vulnerability in OpenSTAManager's Scadenzario (Payment Schedule) print template allows any authenticated user to extract sensitive data from the database, including admin credentials, customer information, and financial records. The vulnerability exists in templates/scadenzario/init.php, where the id_anagrafica parameter is directly concatenated into an SQL query without proper sanitization. The vulnerability enables complete database read access through error-based SQL injection techniques.
- Product
- openstamanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026OpenSTAManager is an open source management software for technical assistance and invoicing.CVE-2025-69214 · Other software · devcode-it · reported by GitHubHigh 8.7
OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQL Injection vulnerability exists in the ajax_select.php endpoint when handling the componenti operation. An authenticated attacker can inject malicious SQL code through the options[matricola] parameter.
- Product
- openstamanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026OpenSTAManager is an open source management software for technical assistance and invoicing.CVE-2025-69212 · Other software · devcode-it · reported by GitHubCritical 9.4
OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server.
- Product
- openstamanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.