Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
33 results
Aug 22, 2026Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access chCVE-2026-77992 · Websites & servers · reported by security@joomla.orgCritical 9.5
Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied input in the jsactions feature leads to an storedCVE-2026-77027 · Websites & servers · reported by security@joomla.orgHigh 8.6
Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied input in the jsactions feature leads to an stored XSS vector.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checksCVE-2026-76609 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any acCVE-2026-76608 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any access checks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2.CVE-2026-76607 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.CVE-2026-76606 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2.CVE-2026-76605 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 - The PHP form element is vulnerable to the execuCVE-2026-76604 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The inineedit form controller does not perform any acceCVE-2026-76603 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without vaCVE-2026-76602 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks.CVE-2026-76601 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks.CVE-2026-76600 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements modCVE-2026-76599 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements model allows listings of arbitrary database tables including columns.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elemCVE-2026-76598 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elements model allows arbitrary directory listings.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller aCVE-2026-76597 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, aCVE-2026-76596 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list CVE-2026-76571 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared CVE-2026-73974 · Computers, phones & browsers · Linuxfabrik · reported by GitHubMedium 5.5
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test() treated the first or second element of a --test CSV argument as a filesystem path and returned the file contents as simulated standard output or standard error without path confinement. The hidden but production-accessible --test argument was accepted by sudo-authorized plugins, so an attacker controlling the nagios or icinga account could use check-plugins/deb-updates/deb-updates with its default QUERY=1 to disclose every line of a root-readable file. Approximately 22 other plugins exposed filtered content or a root file existence and readability oracle through the same helper, while check-plugins/network-bonding/network-bonding and check-plugins/openstack-swift-stat/openstack-swift-stat had direct read paths that bypassed the helper. The library fix confines fixture reads to the invoking plugin's unit-test directory and refuses unsafe anchors, and the plugin fix routes the two bypasses through tha
- Product
- monitoring-plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems.CVE-2026-73973 · Computers, phones & browsers · Linuxfabrik · reported by GitHubMedium 5.5
Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 7.0.0, check-plugins/logfile/logfile accepted a free-form --filename path and opened it as root when invoked through the shipped nagios or icinga sudoers allowlist, without confining the resolved path to /var/log. An attacker who controls the monitoring account can select a root-readable file such as /etc/shadow and use --warning-regex . while leaving SUPPRESS_OUTPUT false, causing each nonempty line to be collected in warn_matches and returned through lib.base.oao(). The vulnerable flow passes the expanded scan_path directly to open(), and neither real-path containment nor an allowlist protects the sink. The same fix also confines mysql-logfile and openvpn-client-list paths, allows only documented log roots, and resolves symlinks and parent-directory traversal before checking containment. This issue is fixed in version 7.0.0.
- Product
- monitoring-plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modulCVE-2026-55426 · Computers, phones & browsers · Linuxfabrik · reported by GitHubHigh 7.8
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0.
- Product
- monitoring-plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations.CVE-2026-53759 · Computers, phones & browsers · Linuxfabrik · reported by GitHubLow 2
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, db_sqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who controls a local monitoring account can create a symlink such as /tmp/linuxfabrik-monitoring-plugins-docker-stats.db and then trigger a sudo-authorized plugin, causing the root process to create or modify the symlink target. The primitive can overwrite arbitrary paths, cause denial of service, or manipulate an existing SQLite database through a crafted rollback journal or write-ahead log. The Monitoring Plugins integration also moved plugin caches through lib.db_sqlite.get_db_path() so they use the secured per-user directory. This issue is fixed in version 4.2.0.
- Product
- monitoring-plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems.CVE-2026-52817 · Computers, phones & browsers · Linuxfabrik · reported by GitHubHigh 7
Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 5.1.0, the shipped assets/sudoers/Debian.sudoers policy allowed the nagios or icinga account to execute /usr/bin/apt-get as root without restricting its arguments. An attacker who already controls that monitoring account can supply the APT::Update::Pre-Invoke option to execute an arbitrary command while apt-get runs with root privileges, resulting in a root shell and complete compromise of the host. The vulnerable rule supports the check-plugins/deb-updates/deb-updates plugin, but it authorized arbitrary apt-get argument sequences rather than only the required apt-get update --quiet 2 command. This issue is fixed in version 5.1.0.
- Product
- monitoring-plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated attacker could execute arbitrary code by using thCVE-2026-67282 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated attacker could execute arbitrary code by using the frontend listfilter model.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc featCVE-2026-66915 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc plugin.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfabrikar.commysites.guru
Jul 29, 2026Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems.CVE-2026-67436 · Computers, phones & browsers · Linuxfabrik · reported by GitHubHigh 8.3
Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish-* plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or compromised BMC to redirect authenticated Redfish requests and disclose X-Auth-Token or HTTP Basic credentials.
- Product
- monitoring-plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations.CVE-2026-67435 · Computers, phones & browsers · Linuxfabrik · reported by GitHubMedium 6
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 6.0.0, lib.url.fetch() followed cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, allowing a malicious redirect-capable server to receive headers such as X-Auth-Token from authenticated monitoring requests. This issue is fixed in version 6.0.0.
- Product
- monitoring-plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems.CVE-2026-67433 · Computers, phones & browsers · Linuxfabrik · reported by GitHubMedium 5.8
Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename() and allowed a local user controlling the plugin account to place a symlink that would be followed by sqlite3.connect() during a root-run check.
- Product
- monitoring-plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026Joomla com_fabrik 3.9.11 contains a directory traversal vulnerability that allows unauthenticated attackers to list arbitrary files by manipulating the folder pCVE-2020-37219 · Websites & servers · reported by VulnCheckHigh 8.7
Joomla com_fabrik 3.9.11 contains a directory traversal vulnerability that allows unauthenticated attackers to list arbitrary files by manipulating the folder parameter. Attackers can send GET requests to the onAjax_files method with path traversal sequences to enumerate files in system directories outside the intended web root.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfabrikar.comfabrikar.com
Oct 29, 2019Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component through v3.8.1 for Joomla! allows remoteCVE-2018-10727 · Other software · Fabrikar · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component through v3.8.1 for Joomla! allows remote attackers to inject arbitrary web script via the HTTP Referer header.
- Product
- Fabrik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2011Unrestricted file upload vulnerability in models/importcsv.php in the Fabrik (com_fabrik) component before 2.1.1 for Joomla! allows remote authenticated users wCVE-2011-5004 · Other software · Fabrikar · reported by MITREMedium 6
Unrestricted file upload vulnerability in models/importcsv.php in the Fabrik (com_fabrik) component before 2.1.1 for Joomla! allows remote authenticated users with Manager privileges to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
- Product
- COM Fabrikar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2011Cross-site scripting (XSS) vulnerability in index.php in Ecomat CMS 5.0 allows remote attackers to inject arbitrary web script or HTML via the lang parameter inCVE-2010-5030 · Other software · Codefabrik · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in Ecomat CMS 5.0 allows remote attackers to inject arbitrary web script or HTML via the lang parameter in a web action.
- Product
- Ecomat CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Nov 2, 2011SQL injection vulnerability in index.php in Ecomat CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the show parameter in a web action.CVE-2010-5029 · Other software · Codefabrik · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in Ecomat CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the show parameter in a web action.
- Product
- Ecomat CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
May 19, 2010Directory traversal vulnerability in the Fabrik (com_fabrik) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a ..CVE-2010-1981 · Other software · Fabrikar · reported by MITREMedium 6.8
Directory traversal vulnerability in the Fabrik (com_fabrik) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
- Product
- Fabrik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.