Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,315 results · page 93 of 347
Jan 26, 2026A flaw has been found in Hisense TransTech Smart Bus Management System up to 20260113.CVE-2026-1449 · Other software · Hisense TransTech · reported by VulDBMedium 5.5
A flaw has been found in Hisense TransTech Smart Bus Management System up to 20260113. Affected is the function Page_Load of the file YZSoft/Forms/XForm/BM/BusComManagement/TireMng.aspx. Executing a manipulation of the argument key can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart Bus Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privilCVE-2026-24428 · Other software · Shenzhen Tenda Technology Co., Ltd. · reported by VulnCheckHigh 8.7
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an attacker can bypass role-based restrictions enforced by the web interface and obtain full administrative privileges.
- Product
- W30E V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtendacn.comvulncheck.com
Jan 26, 2026Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows a local attacker to access the managemeCVE-2025-57784 · Other software · Hiawatha · reported by cret@cert.orgLow 3.3
Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows a local attacker to access the management client.
- Product
- Hiawatha Web server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026Xeroneit Library Management System 3.1 contains a stored cross-site scripting vulnerability in the Book Category feature that allows administrators to inject maCVE-2020-36954 · Other software · Xeroneit · reported by VulnCheckMedium 5.1
Xeroneit Library Management System 3.1 contains a stored cross-site scripting vulnerability in the Book Category feature that allows administrators to inject malicious scripts. Attackers can insert a payload in the Category Name field to execute arbitrary JavaScript code when the page is loaded.
- Product
- Xeroneit Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Jan 26, 2026A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe).CVE-2025-59094 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.4
A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within this application it is possible to specify an arbitrary executable as well as the weekday and start time, when the specified executable should be run with SYSTEM privileges.
- Product
- Kaba exos 9300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comr.sec-consult.com
Jan 25, 2026A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12.CVE-2026-1414 · Other software · Sangfor · reported by VulDBLow 2.1
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the file /equipment/get_Information of the component HTTP POST Request Handler. Executing a manipulation of the argument fortEquipmentIp can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Operation and Maintenance Security Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2026A vulnerability was found in Sangfor Operation and Maintenance Security Management System up to 3.0.12.CVE-2026-1413 · Other software · Sangfor · reported by VulDBLow 2.1
A vulnerability was found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function portValidate of the file /fort/ip_and_port/port_validate of the component HTTP POST Request Handler. Performing a manipulation of the argument port results in command injection. The attack can be initiated remotely. The exploit has been made public and could be used.
- Product
- Operation and Maintenance Security Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2026A vulnerability has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.12.CVE-2026-1412 · Other software · Sangfor · reported by VulDBMedium 5.5
A vulnerability has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. The impacted element is an unknown function of the file /fort/audit/get_clip_img of the component HTTP POST Request Handler. Such manipulation of the argument frame/dirno leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Operation and Maintenance Security Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24412 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have aHeap Buffer Overflow vulnerability in the CIccTagXmlSegmentedCurve::ToXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24411 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior in CIccTagXmlSegmentedCurve::ToXml(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24410 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24409 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Pointer Deference in CIccTagXmlFloatNum<>::ParseXml(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24407 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior in icSigCalcOp(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24406 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buffer Overflow vulnerability in CIccTagNamedColor2::SetSize(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24405 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buffer Overflow vulnerability in CIccMpeCalculator::Read(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24404 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, CIccXmlArrayType() contains a Null Pointer Dereference and Undefined Behavior vulnerability. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles.CVE-2026-24403 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, an integer overflow vulnerability exists in icValidateStatus CIccProfile::CheckHeader() when user-controllable input is incorporated into profile data unsafely. Tampering with tag tables, offsets, or size fields can trigger parsing errors, memory corruption, or DoS, potentially enabling arbitrary Code Execution or bypassing application logic. This issue has been fixed in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, UnsubCVE-2026-22586 · Other software · Salesforce · reported by security@salesforce.comCritical 9.8
Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
- Product
- Marketing Cloud Engagement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, SubscrCVE-2026-22585 · Other software · Salesforce · reported by security@salesforce.comCritical 9.8
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
- Product
- Marketing Cloud Engagement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module)CVE-2026-22583 · Other software · Salesforce · reported by security@salesforce.comCritical 9.8
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
- Product
- Marketing Cloud Engagement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) CVE-2026-22582 · Other software · Salesforce · reported by security@salesforce.comCritical 9.8
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
- Product
- Marketing Cloud Engagement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform thru 2025-05-28.CVE-2025-52026 · Other software · Aptsys · reported by MITREHigh 7.5
An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform thru 2025-05-28. This unauthenticated endpoint returns a list of cashier accounts, including names, email addresses, usernames, and passwords hashed using MD5. As MD5 is a broken cryptographic function, the hashes can be easily reversed using public tools, exposing user credentials in plaintext. This allows remote attackers to perform unauthorized logins and potentially gain access to sensitive POS operations or backend functions.
- Product
- Gemscms Backend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28.CVE-2025-52025 · Other software · Aptsys · reported by MITRECritical 9.4
An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28. The vulnerability arises because user input is directly inserted into a dynamic SQL query syntax without proper sanitization or parameterization. This allows an attacker to inject and execute arbitrary SQL code by submitting crafted input in the id parameter, leading to unauthorized data access or modification.
- Product
- Gemscms Backend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users.CVE-2025-52024 · Other software · Aptsys · reported by MITRECritical 9.4
A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available backend services and POS web services, each with an HTML form for submitting test input. These panels are intended for developer use, but are accessible in production environments with no authentication or session validation. This grants any external actor the ability to discover, test, and execute API endpoints that perform critical functions including but not limited to user transaction retrieval, credit adjustments, POS actions, and internal data queries.
- Product
- Gemscms Backend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026A vulnerability in the PHP backend of gemscms.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that discCVE-2025-52023 · Other software · Aptsys · reported by MITREMedium 5.3
A vulnerability in the PHP backend of gemscms.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that disclose internal file paths, code snippets, and stack traces. This occurs when specially crafted HTTP GET/POST requests are sent to public API endpoints, exposing potentially sensitive information useful for further exploitation. This issue is classified under CWE-209: Information Exposure Through an Error Message.
- Product
- Gemscms Backend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026A vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that CVE-2025-52022 · Other software · Aptsys · reported by MITREMedium 5.3
A vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that disclose internal file paths, code snippets, and stack traces. This occurs when specially crafted HTTP GET/POST requests are sent to public API endpoints, exposing potentially sensitive information useful for further exploitation. This issue is classified under CWE-209: Information Exposure Through an Error Message.
- Product
- Gemscms Backend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026KiviCare – Clinic & Patient Management System (EHR): Arbitrary file uploadsCVE-2026-0927 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization checks in the uploadMedicalReport() function in all versions up to, and including, 3.6.15. This makes it possible for unauthenticated attackers to upload text files and PDF documents to the affected site's server which may be leveraged for further attacks such as hosting malicious content or phishing pages via PDF files.
- Product
- KiviCare – Clinic & Patient Management System (EHR)
- Affected
- up to 3.6.15
- What to do
- Affects up to 3.6.15. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability.CVE-2026-0755 · Other software · Gemini MCP Tool · reported by zdi-disclosures@trendmicro.comCritical 9.8
gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27783.
- Product
- gemini-mcp-tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-24138 · Other software · FOGProject · reported by GitHubHigh 7.5
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticated SSRF vulnerability in getversion.php which can be triggered by providing a user-controlled url parameter. It can be used to fetch both internal websites and files on the machine running FOG. This appears to be reachable without an authenticated web session when the request includes newService=1. The issue does not have a fixed release version at the time of publication.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuCVE-2025-68609 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.6
A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuration. The defect resulted in both authentication and authorization checks being bypassed, potentially allowing any network-accessible client to view system logs and perform operations without valid credentials. No evidence of exploitation was identified during the vulnerability window.
- Product
- com.palantir.aries:aries
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026File Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818 allows a remote attacker to execute arbitrary code via the Logo uCVE-2025-69828 · Other software · reported by MITRECritical 10
File Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818 allows a remote attacker to execute arbitrary code via the Logo upload in /Customer/AddEdit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtmsglobalsoft.com
Jan 22, 2026A path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software.CVE-2025-69612 · Other software · Tmsglobalsoft · reported by MITREMedium 6.5
A path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software. The "Download Template" function in the profile dashboard does not neutralize directory traversal sequences (../) in the filePath parameter, allowing authenticated users to read arbitrary files, such as the server's Web.config.
- Product
- TMS Management Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtmsglobalsoft.com
Jan 22, 2026A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12.CVE-2026-1325 · Other software · Sangfor · reported by VulDBMedium 5.5
A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function edit_pwd_mall of the file /fort/login/edit_pwd_mall. The manipulation of the argument flag results in weak password recovery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Operation and Maintenance Security Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.12.CVE-2026-1324 · Other software · Sangfor · reported by VulDBHigh 7.4
A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.12. Affected by this issue is the function SessionController of the file /isomp-protocol/protocol/session of the component SSH Protocol Handler. The manipulation of the argument keypassword leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Operation and Maintenance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Authorization Bypass Through User-Controlled Key vulnerability in EXERT Computer Technologies Software Ltd.CVE-2025-10024 · Other software · EXERT Computer Technologies Software Ltd. Co. · reported by iletisim@usom.gov.trHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in EXERT Computer Technologies Software Ltd. Co. Education Management System allows Parameter Injection. This issue affects Education Management System: through 23.09.2025.
- Product
- Education Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24039 · Other software · horilla-opensource · reported by GitHubMedium 4.3
Horilla is a free and open source Human Resource Management System (HRMS). Version 1.4.0 has Improper Access Control, allowing low-privileged employees to self-approve documents they have uploaded. The document-approval UI is intended to be restricted to administrator or high-privilege roles only; however, an insufficient server-side authorization check on the approval endpoint lets a standard employee modify the approval status of their own uploaded document. A successful exploitation allows users with only employee-level permissions to alter application state reserved for administrators. This undermines the integrity of HR processes (for example, acceptance of credentials, certifications, or supporting materials), and may enable submission of unvetted documents. This issue is fixed in version 1.5.0.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24038 · Other software · horilla-opensource · reported by GitHubHigh 8.1
Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from their POST request, the user-supplied OTP is also None, causing the comparison user_otp == otp to pass. This allows an attacker to bypass two-factor authentication entirely without ever providing a valid OTP. If administrative accounts are targeted, it could lead to compromise of sensitive HR data, manipulation of employee records, and further system-wide abuse. This issue has been fixed in version 1.5.0.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24037 · Other software · horilla-opensource · reported by GitHubMedium 4.8
Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the has_xss() function attempts to block XSS by matching input against a set of regex patterns. However, the regexes are incomplete and context-agnostic, making them easy to bypass. Attackers are able to redirect users to malicious domains, run external JavaScript, and steal CSRF tokens that can be used to craft CSRF attacks against admins. This issue has been fixed in version 1.5.0.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24036 · Other software · horilla-opensource · reported by GitHubMedium 5.3
Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication. The response includes draft job titles, descriptions and application link allowing unauthenticated users to view unpublished roles and access the application workflow for unpublished jobs. Unauthorized access to unpublished job posts can leak sensitive internal hiring information and cause confusion among candidates. This issue has been fixed in version 1.5.0.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24035 · Other software · horilla-opensource · reported by GitHubMedium 4.3
Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exists in Horilla HR Software starting in version 1.4.0 and prior to version 1.5.0, allowing any authenticated employee to upload documents on behalf of another employee without proper authorization. This occurs due to insufficient server-side validation of the employee_id parameter during file upload operations, allowing any authenticated employee to upload document in behalf of any employee. Version 1.5.0 fixes the issue.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24034 · Other software · horilla-opensource · reported by GitHubMedium 5.4
Horilla is a free and open source Human Resource Management System (HRMS). In versions prior to 1.5.0, a cross-site scripting vulnerability can be triggered because the extension and content-type are not checked during the profile photo update step. Version 1.5.0 fixes the issue.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Horilla is a free and open source Human Resource Management System (HRMS).CVE-2026-24010 · Other software · horilla-opensource · reported by GitHubHigh 8
Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload vulnerability in versions prior to 1.5.0, with Social Engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disguised as a profile picture, an attacker can create a convincing login page replica that steals user credentials. When a victim visits the uploaded file URL, they see an authentic-looking "Session Expired" message prompting them to re-authenticate. All entered credentials are captured and sent to the attacker's server, enabling Account Takeover. Version 1.5.0 patches the issue.
- Product
- horilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2026-23952 · Other software · ImageMagick · reported by GitHubMedium 6.5
ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Tendenci is an open source content management system built for non-profits, associations and cause-based sites.CVE-2026-23946 · Other software · tendenci · reported by GitHubMedium 6.8
Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python's pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12.
- Product
- tendenci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.python.orggithub.com
Jan 21, 2026Group-Office is an enterprise customer relationship management and groupware tool.CVE-2026-23887 · Other software · Intermesh · reported by GitHubMedium 5.1
Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application stores unsanitized filenames in the database, which can lead to Stored Cross-Site Scripting (XSS). Users who interact with these specially crafted file names within the Group-Office application are affected. While the scope is limited to the file-viewing context, it could still be used to interfere with user sessions or perform unintended actions in the browser. This issue is fixed in versions 6.8.149 and 25.0.80.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Fleet is open source device management software.CVE-2026-23518 · Other software · fleetdm · reported by GitHubCritical 9.3
Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vulnerability in Fleet's Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities. Versions 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.
- Product
- fleet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Fleet is open source device management software.CVE-2026-23517 · Other software · fleetdm · reported by GitHubMedium 6.3
Fleet is open source device management software. A broken access control issue in versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations. Fleet’s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege “Observer” role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service. Versions 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist as a workaround.
- Product
- fleet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026fleetdm/fleet is open source device management software.CVE-2026-22808 · Other software · fleetdm · reported by GitHubMedium 5.5
fleetdm/fleet is open source device management software. Prior to versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, if Windows MDM is enabled, an unauthenticated attacker can exploit this XSS vulnerability to steal a Fleet administrator's authentication token (FLEET::auth_token) from localStorage. This could allow unauthorized access to Fleet, including administrative access, visibility into device data, and modification of configuration. Versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.
- Product
- fleet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026ManageIQ is an open-source management platform.CVE-2026-22598 · Other software · ManageIQ · reported by GitHubHigh 7.1
ManageIQ is an open-source management platform. A flaw was found in the ManageIQ API prior to version radjabov-2 where a malformed TimeProfile could be created causing later UI and API requests to timeout leading to a Denial of Service. Version radjabov-2 contains a patch. One may also apply the patch manually.
- Product
- manageiq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Genexis Platinum-4410 P4410-V2-1.31A contains a stored cross-site scripting vulnerability in the 'start_addr' parameter of the Security Management interface.CVE-2021-47858 · Other software · Genexis · reported by VulnCheckMedium 5.1
Genexis Platinum-4410 P4410-V2-1.31A contains a stored cross-site scripting vulnerability in the 'start_addr' parameter of the Security Management interface. Attackers can inject malicious scripts through the start source address field that will persist and trigger for privileged users when they access the security management page.
- Product
- Platinum-4410
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgenexis.euexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.