Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Oct 16, 2026FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonatinCVE-2026-111642 · Other software · fastapiadmin · reported by VulnCheckHigh 8.7
FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.
- Product
- FastapiAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotCVE-2026-111641 · Other software · fastapiadmin · reported by VulnCheckCritical 9.3
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.
- Product
- FastapiAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026A markdown based cross-site scripting (XSS) vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execute arbitrary web scrCVE-2026-36728 · Other software · reported by MITREMedium 5.4
A markdown based cross-site scripting (XSS) vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a chat message.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026A markdown based cross-site scripting (XSS) vulnerability in the /system/notice/create endpoint of FastapiAdmin v2.2.0 allows attackers to execute arbitrary webCVE-2026-36725 · Other software · reported by MITREMedium 6.1
A markdown based cross-site scripting (XSS) vulnerability in the /system/notice/create endpoint of FastapiAdmin v2.2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the notice_content parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026An uncaught exception in the /application/job/update/{id} endpoint of FastapiAdmin v2.2.0 allows authenticated attackers with the module_task:job:update permissCVE-2026-36724 · Other software · reported by MITREMedium 6.5
An uncaught exception in the /application/job/update/{id} endpoint of FastapiAdmin v2.2.0 allows authenticated attackers with the module_task:job:update permission to cause a Denial of Service (DoS) via manipulating the func field of scheduled tasks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A flaw has been found in FastApiAdmin up to 2.2.0.CVE-2026-2979 · Other software · Fastapiadmin · reported by VulDBLow 2.1
A flaw has been found in FastApiAdmin up to 2.2.0. This issue affects the function user_avatar_upload_controller of the file /backend/app/api/v1/module_system/user/controller.py of the component Scheduled Task API. Executing a manipulation can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.
- Product
- Fastapiadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability was detected in FastApiAdmin up to 2.2.0.CVE-2026-2978 · Other software · Fastapiadmin · reported by VulDBLow 2.1
A vulnerability was detected in FastApiAdmin up to 2.2.0. This vulnerability affects the function upload_file_controller of the file /backend/app/api/v1/module_system/params/controller.py of the component Scheduled Task API. Performing a manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used.
- Product
- Fastapiadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A security vulnerability has been detected in FastApiAdmin up to 2.2.0.CVE-2026-2977 · Other software · Fastapiadmin · reported by VulDBLow 2.1
A security vulnerability has been detected in FastApiAdmin up to 2.2.0. This affects the function upload_controller of the file /backend/app/api/v1/module_common/file/controller.py of the component Scheduled Task API. Such manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
- Product
- Fastapiadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A weakness has been identified in FastApiAdmin up to 2.2.0.CVE-2026-2976 · Other software · Fastapiadmin · reported by VulDBLow 2.1
A weakness has been identified in FastApiAdmin up to 2.2.0. Affected by this issue is the function download_controller of the file /backend/app/api/v1/module_common/file/controller.py of the component Download Endpoint. This manipulation of the argument file_path causes information disclosure. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- Fastapiadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A security flaw has been discovered in FastApiAdmin up to 2.2.0.CVE-2026-2975 · Other software · Fastapiadmin · reported by VulDBMedium 5.5
A security flaw has been discovered in FastApiAdmin up to 2.2.0. Affected by this vulnerability is the function reset_api_docs of the file /backend/app/plugin/init_app.py of the component Custom Documentation Endpoint. The manipulation results in information disclosure. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
- Product
- Fastapiadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.