Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,661 results · page 1 of 394
Oct 30, 2026Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest apCVE-2026-59388 · Other software · Cloud Foundry Foundation · reported by security@vmware.comMedium 6.5
Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.
- Product
- CAPI (Cloud Foundry Controller)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Content Egg: Unauthorized modification of dataCVE-2026-119059 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce ('contentegg_metabox') and the generic 'edit_posts' capability, but trusts the attacker-supplied $_POST['post_id'] verbatim and never calls current_user_can('edit_post', $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on arbitrary posts, including those owned by administrators.
- Product
- Content Egg
- Affected
- up to 12.0.0
- What to do
- Affects up to 12.0.0. Update Content Egg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026WP Visitor Statistics (Real Time Traffic): Does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboardCVE-2026-117571 · WordPress plugins & themes · reported by WPScan
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 8.8
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 8.8 or newer.
Oct 30, 2026Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data.CVE-2026-118568 · Websites & servers · Drupal · reported by mlhess@drupal.org
Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.
- Product
- Content Sync (content-sync.io)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection.CVE-2026-118562 · Websites & servers · Drupal · reported by mlhess@drupal.org
Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
- Product
- Single Content Sync
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data.CVE-2026-118551 · Websites & servers · Drupal · reported by mlhess@drupal.org
Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Product
- AI (Artificial Intelligence)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing.CVE-2026-118544 · Websites & servers · Drupal · reported by mlhess@drupal.org
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
- Product
- Commerce Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS.CVE-2026-114555 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions: from 0.0.0 to 2.0.14.
- Product
- Data field
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing.CVE-2026-107268 · Websites & servers · Drupal · reported by mlhess@drupal.org
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.
- Product
- Two Factor Authentication - TFA / Passwordless Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases.CVE-2026-119281 · Other software · mariadb-corporation · reported by GitHubMedium 5.9
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
- Product
- mariadb-connector-j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases.CVE-2026-119280 · Other software · mariadb-corporation · reported by GitHubLow 3.7
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
- Product
- mariadb-connector-j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases.CVE-2026-119279 · Other software · mariadb-corporation · reported by GitHubMedium 5.9
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength() and ReadableByteBuf.readIntLengthEncodedNotNull() methods narrowed the protocol's unsigned 8-byte length-encoded integer to a Java int without checking that the value fit a non-negative integer. Values above Integer.MAX_VALUE could wrap to a negative or unrelated length that downstream allocation and read paths used. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger NegativeArraySizeException, out-of-bounds failures, or oversized allocation behavior in client connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.10.
- Product
- mariadb-connector-j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases.CVE-2026-119278 · Other software · mariadb-corporation · reported by GitHubMedium 5.9
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during caching_sha2_password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the server-declared length, and authResult[0] was accessed without ensuring a byte existed. A malicious or compromised server, or a machine-in-the-middle attacker, could declare a very large length or send an empty response before any password was transmitted. The malformed packet could cause excessive allocation or an unchecked ArrayIndexOutOfBoundsException escaping from DriverManager.getConnection(). This issue is fixed in versions 3.3.7 and 3.4.5.
- Product
- mariadb-connector-j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases.CVE-2026-119277 · Other software · mariadb-corporation · reported by GitHubMedium 5.9
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create sub-buffers, or decode strings beyond the packet boundary. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures inside JDBC calls and terminate connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
- Product
- mariadb-connector-j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases.CVE-2026-119276 · Other software · mariadb-corporation · reported by GitHubMedium 5.9
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT_SESSION_TRACK was negotiated, the OkPacket.parse() and OkPacket.parseWithInfo() paths allocated byte arrays using server-declared lengths for the OK packet info field and session-state variable names and values before confirming that the bytes remained in the packet. A malicious or compromised server, or a machine-in-the-middle attacker, could send a small OK packet declaring a much larger length and repeatedly force attacker-controlled heap allocations before the subsequent copy failed. This could create garbage-collection pressure or an OutOfMemoryError in the client application. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
- Product
- mariadb-connector-j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases.CVE-2026-119210 · Other software · mariadb-corporation · reported by GitHubMedium 5.9
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName() check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string literals, or comments instead of requiring a real statement. A malicious or compromised server, or a machine-in-the-middle attacker, could return crafted database or table identifiers that the connector reused in metadata or updatable-result queries, then answer with a LOCAL INFILE request for a client file. With allowLocalInfile enabled, this caused the connector to stream any readable client-host file named by the crafted text, including through DatabaseMetaData.getImportedKeys(), DatabaseMetaData.getExportedKeys(), or ResultSet.updateRow() paths. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
- Product
- mariadb-connector-j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1).CVE-2026-8824 · Other software · vtk · reported by talos-cna@cisco.comHigh 7.5
A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1). A specially crafted .bmp file can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- vtk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comvtk.org
Oct 29, 2026HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to chaCVE-2026-119168 · Other software · HashiCorp · reported by security@hashicorp.comHigh 8.8
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
- Product
- Nomad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026joi is a schema description language and data validator for JavaScript.CVE-2026-118772 · Other software · hapijs · reported by GitHubHigh 7.5
joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.
- Product
- joi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon databaseCVE-2026-11587 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7High 7.2
SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database
- Product
- Centreon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthewatch.centreon.comundefined
Oct 29, 2026Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.CVE-2026-107047 · Other software · reported by MITREHigh 7.5
Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Document Library Lite: Insertion of Sensitive Information Into Sent DataCVE-2026-48200 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0.
- Product
- Document Library Lite
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Document Library Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.CVE-2026-118083 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests.CVE-2026-115795 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeMedium 5.3
P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the block length of the following block is read past the end of the buffer. In addition, a DCP Set block with a length smaller than the two-byte block qualifier makes the length underflow, so the block is processed with a length of 65534 bytes. This can cause a crash (denial of service) or disclose a small amount of memory content. Requires ADJACENT network access.
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checkinCVE-2026-115794 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeLow 2.3
P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the callback receive a length of up to 65507 bytes. An application that copies the reported number of bytes reads past the end of the receive buffer. The attacker must have established an Application Relationship and requires ADJACENT network access. Applications that do not use the alarm data are not affected.
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly CCVE-2026-112256 · Other software · OpenText · reported by security@opentext.comCritical 9.2
Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.
- Product
- Advanced Authentication Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.microfocus.comdocs.microfocus.com
Oct 29, 2026P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has inCVE-2026-112200 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeHigh 8.7
P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has incorrect endianness. The session and its AR remain allocated, so repeated requests exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service.
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind().CVE-2026-111735 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeHigh 7.1
P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long enough. A crafted short frame makes the offset wrap around, so the function reads outside the receive buffer. This can cause a crash (denial of service) or disclose memory content.
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of theCVE-2026-111732 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeCritical 9.3
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block length. A crafted Connect request causes an out-of-bounds write. This can lead to a crash (denial of service) or potentially arbitrary code execution. This option is disabled by default.
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module).CVE-2026-111731 · Other software · RT-Labs · reported by 4b71179a-3b92-4a9d-b9fc-af8b8ed579eeHigh 8.7
P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The loop over the ports never advanced to the next port, so the request never completes and the device stops responding. A remote unauthenticated attacker can use this to cause a denial of service.
- Product
- P-Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and cCVE-2026-107040 · Other software · reported by MITRE
Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data aCVE-2026-107038 · Other software · reported by MITRE
Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data.CVE-2026-107034 · Other software · reported by MITRE
Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.CVE-2026-107029 · Other software · reported by MITRE
Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data acCVE-2026-107027 · Other software · reported by MITRE
Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.CVE-2026-107025 · Other software · reported by MITRE
Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.CVE-2026-104324 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to dataCVE-2026-115713 · Other software · Elastic · reported by security@elastic.coHigh 7.5
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132).
- Product
- Elastic Cloud Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data bCVE-2026-115709 · Other software · Elastic · reported by security@elastic.coHigh 8.2
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).
- Product
- Elastic Cloud Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database.CVE-2026-107015 · Other software · reported by MITRECritical 9.1
Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database.CVE-2026-107014 · Other software · reported by MITRE
Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid: Do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserializedCVE-2026-103693 · WordPress plugins & themes · reported by WPScanCritical 9
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.
- Product
- Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid
- Fixed in
- 3.0.5
- What to do
- Update Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid to 3.0.5 or newer.
Oct 29, 2026Schema App Structured Data: Stored Cross-Site ScriptingCVE-2026-96666 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled the plugin's 'Remove Microdata' option and approves the malicious comment.
- Product
- Schema App Structured Data
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Schema App Structured Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 28, 2026In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution.CVE-2026-66090 · Other software · Apereo Foundation · reported by 9c1820ae-fb77-4810-a8aa-ca46e7474d2fHigh 7.1
In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.
- Product
- openEQUELLA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenequella.github.io
Oct 28, 2026The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages.CVE-2026-114173 · WordPress plugins & themes · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Medium 5.3
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.
- Product
- Ortto
- Fixed in
- 1.0.25
- What to do
- Update Ortto to 1.0.25 or newer.
Oct 28, 2026Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams objeCVE-2026-118803 · Other software · Bricks · reported by VulnCheckHigh 7.5
Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash, without authentication.
- Product
- Bricks Theme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbricksbuilder.iovulncheck.com
Oct 28, 2026The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store.CVE-2026-116641 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.6
The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check. The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0
- Product
- Database Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas.CVE-2026-118666 · Other software · ardatan · reported by GitHubMedium 6
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessage handler whenever a new overlapping subscription starts. The handler delivers LEGACY_WS.DATA frames to the newest observer without comparing data.id with the subscription operation id, so a caller using the same executor can receive another user's authorized subscription payload while the earlier caller's stream is starved. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.
- Product
- graphql-tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas.CVE-2026-118665 · Other software · ardatan · reported by GitHubHigh 8.2
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scoped executorConnectionParams object after cleanupWebsocket closes a connection. When one executor is reused across different authorization contexts, a later request that omits a sensitive key can send an earlier caller's Authorization or tenant value in its connection_init payload, causing the downstream server to authenticate the later caller as the earlier user. Applications that create a new executor for every request are not affected. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.
- Product
- graphql-tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username casCVE-2026-6647 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8High 7.4
In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing mixed-case characters during certain lifecycle events, preventing tokens from being invalidated. A malicious actor can exploit this vulnerability by possessing a valid access or refresh token associated with a mixed-case username. In affected configurations, these tokens may not be revoked when expected. The actor can then leverage these unrevoked tokens, before their expiry, to continue performing actions that should have been restricted, effectively bypassing intended access controls.
- Product
- WSO2 Identity Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.