Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16,425 results · page 91 of 329
Jun 17, 2026Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core).CVE-2026-35263 · Websites & servers · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebLogic Server. While the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
- Product
- WebLogic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place).CVE-2026-35262 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.3
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Data Integrator accessible data as well as unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Data Integrator. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
- Product
- Oracle Data Integrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).CVE-2026-35261 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
- Product
- Oracle Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console).CVE-2026-35259 · Websites & servers · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise WebLogic Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
- Product
- WebLogic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console).CVE-2026-35258 · Websites & servers · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.7
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all WebLogic Server accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
- Product
- WebLogic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026A denial of service security issue exists in the affected product.CVE-2026-11317 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A denial of service security issue exists in the affected product. The security issue stems from a fault occurring when a crafted CIP message is sent. Devices with less memory are more likely to be affected. This can result in a major nonrecoverable fault (MNRF). A program download is required to recover.
- Product
- CompactLogix, ControlLogix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jun 15, 2026Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might allow for escalation of privCVE-2026-5064 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 8.5
Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or denial of service. HP is releasing software updates to mitigate these potential vulnerabilities.
- Product
- HP One Agent Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.CVE-2026-52693 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.
- Affected
- up to 3.5.5
- What to do
- Affects up to 3.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions.CVE-2026-49061 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions.
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions.CVE-2026-48883 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions.
- Affected
- up to 8.5.3
- What to do
- Affects up to 8.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.CVE-2026-45437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in AI Product Search for WooCommerce – Motive Commerce Search <= 1.38.2 versions.CVE-2026-42664 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Access Control in AI Product Search for WooCommerce – Motive Commerce Search <= 1.38.2 versions.
- Affected
- up to 1.38.2
- What to do
- Affects up to 1.38.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.CVE-2026-39499 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.
- Affected
- up to 1.6.19
- What to do
- Affects up to 1.6.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.CVE-2026-34902 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.
- Affected
- up to 4.6.3
- What to do
- Affects up to 4.6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings.CVE-2026-50890 · Other software · reported by MITRECritical 9.8
Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 15, 2026WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or adCVE-2016-20075 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the Products tab custom file field and access them via the upcp-product-file-uploads directory to execute arbitrary code on the server.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordetoilewebdesign.comexploit-db.com
Jun 12, 2026Software installed and run as a non-privileged user may conduct GPU system calls to write to arbitrary freed physical pages.CVE-2026-41158 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceHigh 7.8
Software installed and run as a non-privileged user may conduct GPU system calls to write to arbitrary freed physical pages. Physical memory allocated and freed, without the deferred free mechanism can lead to those resources being used for read/write by the GPU after the kernel module has freed the resource.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Software installed and run as a non-privileged user may conduct intentional GPU sparse memory API calls to cause out of bounds write in the kernel.CVE-2026-34195 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceHigh 8.8
Software installed and run as a non-privileged user may conduct intentional GPU sparse memory API calls to cause out of bounds write in the kernel. The product incorrectly indexes internal state when performing sparse allocation remapping.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on productCVE-2026-50099 · Other software · Naxclow · reported by ics-cert@hq.dhs.govMedium 5.1
During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks.
- Product
- Smart Doorbell X3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space.CVE-2026-42932 · Other software · Naxclow · reported by ics-cert@hq.dhs.govMedium 6.9
Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Because the platform also exposes an endpoint that reveals the current identifier high-water mark, the active fleet can be enumerated.
- Product
- Smart Doorbell X3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account.CVE-2026-50084 · Other software · Aqara · reported by 44488dab-36db-4358-99f9-bc116477f914Critical 9.6
The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is an instance of "CWE-862: Missing Authorization" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6 Critical). When combined with CVE-2026-50082, CVE-50083, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.
- Product
- Cloud Production API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle attack, potentially leading to arbitrary codCVE-2026-40677 · Other software · AMD · reported by psirt@amd.comHigh 7.7
The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle attack, potentially leading to arbitrary code execution.
- Product
- AMD Management Console (AMC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Quest Bot is an opensource Discord Bot.CVE-2026-49347 · Other software · duck-organization · reported by GitHubMedium 5.3
Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest release still creates a new database ticket and Discord channel for every completed ticket modal submission, without checking whether the same user already has an open ticket and without applying a cooldown. This issue has been patched in version 1.1.8.
- Product
- questbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Quest Bot is an opensource Discord Bot.CVE-2026-48485 · Other software · duck-organization · reported by GitHubLow 2.1
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the latest release suppresses mentions when creating, unbanning, unwarning, kicking, muting, and unmuting, but stored warning reasons are still printed by /warns without mention suppression. A moderator can create a warning with @everyone or @here in the reason, then make the bot later output that reason through /warns, causing a mass ping if the bot has permission. This issue has been patched in version 1.1.6.
- Product
- questbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Quest Bot is an opensource Discord Bot.CVE-2026-47197 · Other software · duck-organization · reported by GitHubHigh 7.2
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discord permission bit can use the bot to moderate users above them in the Discord role hierarchy, as long as the bot itself outranks the target. This bypasses Discord’s normal role hierarchy protections and lets lower-ranked moderators ban, kick, timeout, untimeout, warn, or rename higher-ranked users. This issue has been patched in version 1.1.6.
- Product
- questbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Quest Bot is an opensource Discord Bot.CVE-2026-47196 · Other software · duck-organization · reported by GitHubHigh 8.4
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the automod add command trims user input but does not reject an empty result. Adding a rule containing only whitespace stores an empty word. The message listener later checks content.includes(""), which is always true, causing the bot to delete every non-bot guild message. This issue has been patched in version 1.1.6.
- Product
- questbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Quest Bot is an opensource Discord Bot.CVE-2026-47195 · Other software · duck-organization · reported by GitHubHigh 7.1
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands check only guild-level permissions on the invoking member. They do not check the member’s effective permissions in the channel where the command is run. A user denied channel-level moderation permissions can still delete messages or change slowmode through the bot. This issue has been patched in version 1.1.6.
- Product
- questbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Product Filter by WBW: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39494 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection. This issue affects Product Filter by WBW: from n/a through 3.1.2.
- Product
- Product Filter by WBW
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 11, 2026Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.CVE-2026-47189 · Other software · duck-organization · reported by GitHubHigh 8.3
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the AutoMod remove flow looks up and deletes rules by global database ID without verifying that the rule belongs to the guild where the command is executed. A user can learn a victim guild’s AutoMod rule ID through autocomplete, then remove that rule from another guild where they have Manage Server. This issue has been patched in version 1.0.5.
- Product
- quest-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.CVE-2026-47188 · Other software · duck-organization · reported by GitHubLow 2.3
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the latest release suppresses mentions in several moderation commands, but /unban and /unwarn still echo user-controlled reason text in public bot messages without allowedMentions. A moderator can use @everyone or @here in the reason and make the bot send a mass ping. This issue has been patched in version 1.0.5.
- Product
- quest-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.CVE-2026-47177 · Other software · duck-organization · reported by GitHubMedium 5.7
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, a user who can configure bot settings can set the ticket transcript channel to a channel they can read. When tickets are closed, the bot exports the full ticket history and sends it to that configured transcript channel. This can expose private ticket messages to users who could not read the original ticket channel. This issue has been patched in version 1.0.4.
- Product
- quest-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.CVE-2026-47176 · Other software · duck-organization · reported by GitHubMedium 5.7
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, a user who can configure bot settings can enable logging and choose a logging channel they can read. The bot then logs deleted and edited message contents from every channel it can see, including private channels the configuring user cannot access. This issue has been patched in version 1.0.4.
- Product
- quest-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.CVE-2026-47175 · Other software · duck-organization · reported by GitHubLow 2.3
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, several moderation commands echo user-controlled reason text in public bot replies without disabling mention parsing. A moderator who does not have permission to mention everyone can still make the bot send @everyone or @here if the bot has that permission. This issue has been patched in version 1.0.4.
- Product
- quest-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes.CVE-2026-47174 · Other software · duck-organization · reported by GitHubCritical 9.5
In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes. The build workflow runs on pull requests, while the deploy workflow runs with package-write permissions and deployment secrets. If an attacker can make a pull request build satisfy the deploy workflow’s main branch condition, the deploy job checks out the triggering workflow commit, builds it into a Docker image, pushes it as latest, and triggers Dokploy deployment. This can allow attacker-controlled pull request code to become the deployed production site image without being merged. This issue has been patched in version 1.0.1.
- Product
- duck-site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.CVE-2026-47173 · Other software · duck-organization · reported by GitHubMedium 6.3
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a ticket with a reason containing @everyone, @here, user mentions, or role mentions. When the ticket is created, the bot posts the attacker-controlled reason into the new ticket channel without suppressing mentions. If the bot has permission to use those mentions, the attacker can make the bot ping staff or everyone with access to the ticket channel. This issue has been patched in version 1.0.3.
- Product
- quest-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.CVE-2026-47172 · Other software · duck-organization · reported by GitHubCritical 9.5
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, the repository has a privileged deploy workflow that runs after the unprivileged build workflow completes. The build workflow runs on pull requests, and the deploy workflow checks out the triggering workflow’s head_sha, builds that code into a Docker image, pushes it as latest, and triggers production deployment. If an attacker can open a pull request from a branch named main, the deploy workflow condition can treat the PR build as deployable and build the attacker-controlled commit in a privileged deployment context. This can result in malicious container deployment and production bot compromise. This issue has been patched in version 1.0.3.
- Product
- quest-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.CVE-2026-47171 · Other software · duck-organization · reported by GitHubHigh 8.8
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose message contains @everyone or @here. When the reminder triggers, the bot sends the stored message back into the channel without suppressing mass mentions. If the bot has permission to mention everyone, the reminder can ping the entire server or channel later. This issue has been patched in version 1.0.3.
- Product
- quest-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.CVE-2026-47169 · Other software · duck-organization · reported by GitHubHigh 7.5
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a user with Manage Server / ManageGuild, but without Manage Roles or Administrator, can configure the bot’s AutoRole feature to assign an arbitrary role to new members. If the selected role has Administrator and is below the bot’s highest role, the attacker can join with a controlled account and receive full server admin. This issue has been patched in version 1.0.3.
- Product
- quest-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.CVE-2026-47163 · Other software · duck-organization · reported by GitHubHigh 7.2
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.1, any guild member who can invoke slash commands can use /automod add, /automod remove, and /automod list because the command has no Discord default permission requirement and no runtime moderator permission check. An attacker can add a rule matching common text and make the bot delete other users’ messages. This issue has been patched in version 1.0.1.
- Product
- quest-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoCVE-2026-3329 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11High 8.7
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.
- Product
- Nexus Repository Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
Jun 11, 2026Advanced AJAX Product Filters: Missing AuthorizationCVE-2022-45813 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BeRocket Advanced AJAX Product Filters allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Advanced AJAX Product Filters: from n/a through 1.6.3.3.
- Product
- Advanced AJAX Product Filters
- Affected
- up to 1.6.3.3
- What to do
- Affects up to 1.6.3.3. Update Advanced AJAX Product Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 11, 2026YITH WooCommerce Product Slider Carousel: Cross-Site request forgery (CSRF)CVE-2022-44630 · WordPress plugins & themes · reported by PatchstackMedium 4.6
Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Request Forgery. This issue affects YITH WooCommerce Product Slider Carousel: from n/a through 1.16.0.
- Product
- YITH WooCommerce Product Slider Carousel
- Affected
- up to 1.16.0
- What to do
- Affects up to 1.16.0. Update YITH WooCommerce Product Slider Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 10, 2026During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileCVE-2025-10238 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.4
During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System Management Mode (SMM).
- Product
- X13 Gen 6 (Type 21RK, 21RL) Laptops (ThinkPad) BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a specially crafted packet, triggering an exceptionCVE-2026-29116 · Network & remote access · Dahua · reported by cybersecurity@dahuatech.comHigh 8.7
A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a specially crafted packet, triggering an exception that causes the system to reboot unexpectedly, resulting in a denial of service.
- Product
- IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially crafted packet, triggering an exception tCVE-2026-29115 · Network & remote access · Dahua · reported by cybersecurity@dahuatech.comMedium 6.9
A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially crafted packet, triggering an exception that causes the system to reboot unexpectedly, resulting in a denial of service.
- Product
- IPC/SD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026A vulnerability has been found in some Dahua products.CVE-2026-29114 · Network & remote access · Dahua · reported by cybersecurity@dahuatech.comLow 2.3
A vulnerability has been found in some Dahua products. An attacker may obtain the device’s CA root certificate. If that CA is installed and trusted on client systems, the attacker could issue fraudulent certificates trusted by those clients and undermine the certificate trust chain.
- Product
- IPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.sCVE-2026-41726 · Other software · Spring · reported by security@vmware.comMedium 6.5
When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
- Product
- Spring for Apache Kafka
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537CVE-2026-46330 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The implementation attempts to convert an active TCP socket into an SMC socket by modifying the underlying `struct file`, dentry, and inode in-place, which violates core VFS invariants that assume these structures are immutable for an open file, creating a risk of use after free errors and general system instability. Given the severity of this design flaw and the fact that cleaner alternatives (e.g., LD_PRELOAD, BPF) exist for legacy application transparency, the correct course of action is to remove this feature entirely.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 9, 2026Product Catalog 8 1.2: SQL injectionCVE-2016-20065 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the selectedCategory parameter. Attackers can submit POST requests to the admin-ajax.php endpoint with the UpdateCategoryList action to extract sensitive database information from WordPress tables.
- Product
- Product Catalog 8 1.2
- What to do
- Update Product Catalog 8 1.2 to the newest version.
Full record and what to do →NVD recordlenonleite.com.brwordpress.org
Jun 9, 2026Helpfulcrowd Product Reviews: Authorization BypassCVE-2026-8499 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in versions up to, and including, 1.2.9. This is due to the `helpfulcrowd_validate_token()` function using a loose comparison operator (`!=`) instead of a strict comparison (`!==`) when validating the `token` parameter, while the corresponding REST route `/wp-json/helpfulcrowd/v1/update-settings` is registered with a `permission_callback` of `__return_true`, making it reachable by unauthenticated users; submitting a JSON boolean `true` as the `token` value causes PHP's loose comparison to evaluate as equal to the non-empty base64-encoded secret string, bypassing the check entirely. This makes it possible for unauthenticated attackers to invoke `helpfulcrowd_settings_endpoint()` and write arbitrary attacker-controlled key-value pairs directly into the `helpfulcrowd_options` WordPress database option via `update_option()` without any sanitization or allowlist filtering, enabling full unauthenticated modification of the plugin's stored configuration.
- Product
- Helpfulcrowd Product Reviews
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Helpfulcrowd Product Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.