Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
316 results · page 1 of 7
Oct 27, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company KulgCVE-2026-105323 · Other software · Kulga Software and Telecommunications Limited Company · reported by iletisim@usom.gov.trMedium 6.1
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company Kulga News Software allows Reflected XSS. This issue affects Kulga News Software: from v26.7.4 before v26.10.0.
- Product
- Kulga News Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoinCVE-2026-110763 · Other software · zuihou · reported by VulnCheckMedium 5.3
lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant.
- Product
- lamp-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to CVE-2026-110238 · Other software · zofe · reported by VulnCheckHigh 8.7
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.
- Product
- rapyd-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by CVE-2026-108850 · Other software · guy-hartstein · reported by VulnCheckMedium 6.9
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in report_content to make the server fetch internal or external hosts, leaking image responses in returned PDFs and probing reachability.
- Product
- company-research-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the cCVE-2026-108731 · Other software · The-Commit-Company · reported by VulnCheckMedium 5.3
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the can_only_join_via_invite setting. Attackers with the Raven User role can call the join_workspace method to become persistent members, reading and posting in Public and Open channels.
- Product
- raven
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership checCVE-2026-108730 · Other software · The-Commit-Company · reported by VulnCheckMedium 5.3
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check. Authenticated non-members can call get_messages_with_dates or get_all_files_shared_in_channel with predictable channel IDs to read Public channel history and Open/Public channel file metadata across workspaces.
- Product
- raven
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting.CVE-2026-11795 · Websites & servers · Softtr Informatics Trading Limited Company · reported by iletisim@usom.gov.trMedium 5.3
Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack: before 5.03.01.54.
- Product
- E-Commerce Pack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing FuncCVE-2026-86450 · Other software · Parla Auto Automotive Trading Limited Company · reported by iletisim@usom.gov.trHigh 7.5
Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects DetaWix Mobile Web Portal: before v1.0.19.
- Product
- DetaWix Mobile Web Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a hard-coded cryptograCVE-2026-75553 · Other software · Tohoku Electric Power Company, Incorporated · reported by vultures@jpcert.or.jpLow 2.4
Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a hard-coded cryptographic key from the affected product.
- Product
- Tohoku Electric Power "Yorisou e Net" Android App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the backCVE-2026-94183 · Other software · The Browser Company of New York · reported by 59469e6c-7ea7-446f-8e43-06aa32c115e8High 7.4
Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content and increasing the risk of phishing.
- Product
- Arc Search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFCVE-2026-94181 · Other software · The Browser Company of New York · reported by 59469e6c-7ea7-446f-8e43-06aa32c115e8High 7.4
An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.
- Product
- Arc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026microsandbox is an easy, fast, local-first microVM runtime and library.CVE-2026-61670 · Other software · superradcompany · reported by GitHubMedium 6.5
microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandbox_cmd.rs. Other local users or co-resident processes can read these values through the host process table, including /proc process command lines on Linux and process listings on Linux and macOS, for the lifetime of the sandbox. Exploitation does not require code execution inside the sandbox or access to the spawning user's session, and can disclose host-side API keys, tokens, and environment secrets on shared hosts, CI runners, and developer systems. This issue is fixed in version 0.5.10.
- Product
- microsandbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data.CVE-2026-54716 · Other software · valhalla · reported by GitHubHigh 7.5
Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sources_to_targets containing an exclude_polygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area geometry, rather than the other request options, triggers processing in src/loki/polygon_search.cc until the process is terminated by the out-of-memory killer. A single unauthenticated request can therefore stop a public-facing worker. Other endpoints that accept exclude_polygons, including /route, were not verified as affected. No fixed version is available as of this review.
- Product
- valhalla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0CVE-2026-88260 · Other software · Brainzcompany · reported by 09832df1-09c1-45b4-8a85-16c601d30febHigh 8.7
Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion. This issue affects Zenius EMS 8.0: through OAM (Build 109).
- Product
- Zenius EMS 8.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target.CVE-2026-88894 · Other software · grokability · reported by VulnCheckMedium 5.3
Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and an availability check before persisting the checkout. With FMCS enabled, a non-superuser who belongs to at least two companies and holds the assets.checkout permission can POST to /kits/{kit}/checkout with a user_id belonging only to company B and have a company-A asset (and likewise kit licenses, consumables and accessories) assigned to that user, bypassing the company-mismatch check that blocks the same operation on every other checkout path. The issue is fixed in Snipe-IT 8.7.2; it was runtime-verified on v8.6.3 and code-inspected on v8.7.1, and the affected service has lacked the check since 2019, so earlier FMCS deployments are likely also affected.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 9, 2026Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, alloCVE-2026-86767 · Other software · grokability · reported by VulnCheckMedium 5.3
Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tenant data including requested asset names, requester display names and profile links, locations, and expected check-in dates without parameter manipulation.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 9, 2026Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST API.CVE-2026-86750 · Other software · grokability · reported by VulnCheckHigh 8.3
Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store() and ::update(), the user record is filled from the request and saved before the requested company_id / company_ids[] values are filtered against the actor's permitted companies (Company::getIdsForCurrentUser()). On installs using Full Multiple Companies Support (FMCS), a non-superuser holding users.create (or users.edit on a target user) can submit company identifiers for companies outside their scope — including a mix of permitted and foreign ids — causing the account row to be committed to the database before authorization is checked. Where null_company_is_floater=1 is set, the post-hoc filter leaves an empty company pivot and the account is persisted as a "floater" with cross-company visibility, allowing creation or relocation of user accounts across tenant boundaries.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 9, 2026Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceCVE-2026-86743 · Other software · grokability · reported by VulnCheckMedium 5.3
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access validation.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 7, 2026SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may beCVE-2026-44766 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability of the application.
- Product
- SAP S/4HANA (Intercompany Matching and Reconciliation)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-sidCVE-2026-85691 · Other software · The-Vibe-Company · reported by VulnCheckHigh 8.7
MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON response.
- Product
- megaparse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabledCVE-2026-85616 · Other software · grokability · reported by VulnCheckHigh 8.4
Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for acceptances belonging to other companies by exploiting a null check on the legacy users.company_id column.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 1, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TRtek Technological Products Computer Software Hardware InCVE-2026-18210 · Other software · TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store allows SQL Injection. This issue affects Products's Store: before 030631b2.
- Product
- Products's Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce CVE-2026-5218 · Websites & servers · Softtr Informatics Technology Trading Limited Company · reported by iletisim@usom.gov.trMedium 4.3
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting (XSS). This issue affects E-Commerce Pack: before 5.03.01.49.
- Product
- E-Commerce Pack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company SoftCVE-2026-16286 · Other software · TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company · reported by iletisim@usom.gov.trCritical 9.8
Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This issue affects Software Repository Management: before 2fb4acee.
- Product
- Software Repository Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files ouCVE-2026-57863 · Other software · crater-invoice-inc · reported by VulnCheckHigh 8.7
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit unsanitized ZIP entry names passed to PHP's ZipArchive::extractTo() to write arbitrary PHP files into the web-accessible public directory and achieve remote code execution on the server.
- Product
- crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvulncheck.com
Aug 25, 2026The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, bCVE-2026-77142 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 8.8
The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the identifier of a company record from the public directory can submit a modified update request for that record directly and overwrite its data, without the application ever confirming that the visitor owns it.
- Product
- Extension "Industry Directory"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2026Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated atCVE-2026-71507 · Other software · Dolibarr · reported by VulnCheckHigh 7.1
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access to that company. Attackers can inject attacker-controlled IBANs as creditor accounts, which are then written into regenerated SEPA credit-transfer files, redirecting outgoing payments to attacker-controlled accounts.
- Product
- dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2026Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the cCVE-2026-78337 · Other software · Roskus · reported by 4daa8cea-433a-44bd-9456-53b127fc289aMedium 4.8
Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.
- Product
- Prospero Flow CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3 - companyName from the request was written unescaped into an XMLCVE-2026-75955 · Websites & servers · reported by security@joomla.orgMedium 5.1
Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3 - companyName from the request was written unescaped into an XML attribute.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browCVE-2026-18534 · Other software · The Browser Company of New York · reported by 59469e6c-7ea7-446f-8e43-06aa32c115e8High 7.4
ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.
- Product
- ArcSearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role.CVE-2026-50774 · Other software · reported by MITRECritical 9.8
An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and othCVE-2026-71242 · Other software · crater-invoice · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.3
Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.
- Product
- crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id).CVE-2026-55739 · Other software · crater-invoice · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.3
Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).
- Product
- Crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd.CVE-2026-63226 · Other software · Ricoh Company · reported by vultures@jpcert.or.jpMedium 6.9
Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinations. When SSH is enabled on an affected product, SSH port forwarding may be leveraged to connect to other node on the LAN.
- Product
- Ricoh printers and Multifunction Printers (MFPs)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the CVE-2026-12686 · Other software · Adiss · reported by cve-coordination@incibe.esCritical 9.3
An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user’s session, resulting in a cross-tenant authorisation bypass. If this vulnerability is successfully exploited, it allows unauthorised access to sensitive customer information, including billing data, and may enable the unauthorised modification of third-party data.
- Product
- Biloop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2026Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vulnerability.CVE-2026-56809 · Other software · Ricoh Company, Ltd. · reported by vultures@jpcert.or.jpMedium 5.1
Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who accesses a crafted URL.
- Product
- Multiple laser printers and MFPs which implement Ricoh Web Image Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.CVE-2025-69122 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address bar while rendering attacker-controlled conteCVE-2026-12348 · Other software · The Browser Company of New York` · reported by 59469e6c-7ea7-446f-8e43-06aa32c115e8High 7.4
Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address bar while rendering attacker-controlled content, enabling phishing.
- Product
- Arc Search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data.CVE-2026-49294 · Other software · valhalla · reported by GitHubMedium 6.1
Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. Versions 3.6.3 and prior are vulnerable to reflected cross-site scripting (XSS) due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, the value is reflected directly into the HTTP response body with Content-Type: application/javascript, without any validation, output encoding, or allowlist filtering. An attacker can craft a URL containing arbitrary JavaScript in the callback parameter; if a victim is induced to load that URL via a <script src="..."> tag, the injected script executes in the context of the serving origin, potentially leading to session token theft, credential disclosure, or actions performed on behalf of the victim. This issue was not fixed at time of publication.
- Product
- valhalla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026Multiple printer drivers provided by Ricoh Company, Ltd.CVE-2026-50100 · Other software · Ricoh Company, Ltd. · reported by vultures@jpcert.or.jpHigh 8.5
Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. contain a privilege escalation vulnerability. If this vulnerability is exploited, an attacker who can log in to a computer running an affected printer driver could elevate privileges by using a specially crafted driver.
- Product
- Multiple printer drivers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability.CVE-2026-45169 · Other software · CyberArk Software, a Palo Alto Networks Company · reported by psirt@paloaltonetworks.comHigh 8.7
Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability. Under specific circumstances and configuration scenarios, processing unexpected input could potentially lead to an unexpected service termination, resulting in a localized denial of service (DoS). CyberArk Security Bulletin: CA26-17
- Product
- PAM SH Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cyberark.comdocs.cyberark.com
Jun 11, 2026Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be CVE-2026-45170 · Other software · CyberArk Software, a Palo Alto Networks Company · reported by psirt@paloaltonetworks.comHigh 7.5
Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be fully enforced. CyberArk Security Bulletin: CA26-17
- Product
- Vendor PAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5 allow a local attacker to potentially compromise the agent daemon initialization.CVE-2026-45174 · Other software · CyberArk Software, a Palo Alto Networks Company · reported by psirt@paloaltonetworks.comHigh 8.5
Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5 allow a local attacker to potentially compromise the agent daemon initialization. CyberArk Security Bulletin: CA26-19
- Product
- Idira Endpoint Privilege Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw within its internal web-page veriCVE-2026-45173 · Other software · CyberArk Software, a Palo Alto Networks Company · reported by psirt@paloaltonetworks.comHigh 8.4
Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw within its internal web-page verification routines. If an authenticated user navigates to a specially crafted webpage, this interaction could potentially allow a remote attacker to trigger unauthorized application interaction or execution parameters within the context of that authenticated browser session. CyberArk Security Bulletin: CA26-21
- Product
- Identity Browser Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, loCVE-2026-45172 · Other software · CyberArk Software, a Palo Alto Networks Company · reported by psirt@paloaltonetworks.comHigh 8.7
Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host. CyberArk Security Bulletins: CA26-17 and CA26-18
- Product
- PAM Self-Hosted, Privilege Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cyberark.comdocs.cyberark.com
Jun 11, 2026Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14.6.3, 14.2.5,CVE-2026-45171 · Other software · CyberArk Software, a Palo Alto Networks Company · reported by psirt@paloaltonetworks.comHigh 8.7
Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14.6.3, 14.2.5, and 14.0.5, an authenticated, low-privileged user could potentially execute arbitrary code. CyberArk Security Bulletin: CA26-17 and CA26-18
- Product
- Privileged Session Manager, Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cyberark.comdocs.cyberark.com
Jun 11, 2026Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within internal agent validation processes.CVE-2026-45175 · Other software · CyberArk Software, a Palo Alto Networks Company · reported by psirt@paloaltonetworks.comHigh 8.5
Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within internal agent validation processes. A local attacker could potentially bypass built-in security controls or cryptographic validations. Under specific circumstances, this could allow the attacker to circumvent agent self-defense mechanisms and execute unauthorized operations. CyberArk Security Bulletin: CA26-19
- Product
- Idira Endpoint Privilege Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cyberark.comdocs.cyberark.com
Jun 11, 2026Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints.CVE-2026-45178 · Other software · CyberArk Software, a Palo Alto Networks Company · reported by psirt@paloaltonetworks.comHigh 8.4
Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker possessing standard node-level credentials could leverage these endpoints to potentially retrieve unauthorized secrets or cause a denial of service (DoS). CyberArk Security Bulletin: CA26-20
- Product
- Conjur Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cyberark.comdocs.cyberark.com
Jun 11, 2026Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication components.CVE-2026-45177 · Other software · CyberArk Software, a Palo Alto Networks Company · reported by psirt@paloaltonetworks.comCritical 9.1
Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication components. A remote, unauthenticated attacker could exploit this by submitting a specially crafted request. Under specific circumstances, this could allow the attacker to manipulate internal validation mechanisms, potentially leading to a bypass of identity verification and the unauthorized acquisition of an access token. CyberArk Security Bulletin: CA26-20
- Product
- Conjur Cloud (Edge Finding only)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within high-privileged agent components.CVE-2026-45176 · Other software · CyberArk Software, a Palo Alto Networks Company · reported by psirt@paloaltonetworks.comHigh 8.9
Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within high-privileged agent components. A local, low-privileged attacker could exploit this by manipulating an internal communication mechanism or file operation. Under specific circumstances, this could potentially allow the attacker to bypass permission restrictions and execute unauthorized local actions with elevated privileges. CyberArk Security Bulletin: CA26-19
- Product
- Idira Endpoint Privilege Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cyberark.comdocs.cyberark.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.