Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

5,977 results · page 1 of 120

Oct 28, 2026In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxc_update_irCVE-2026-99189 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxc_update_irq_chained_handler() is called before the IRQ domain, the generic IRQ chip, and the port list entry are set up. If an interrupt arrives in that window: - mx3_gpio_irq_handler() calls generic_handle_domain_irq() with port->domain still NULL. - mx2_gpio_irq_handler() walks mxc_gpio_ports, but the port has not been added to the list yet. Additionally, if any of the subsequent probe steps (gpio_generic_chip_init(), devm_gpiochip_add_data(), irq_domain_create_legacy(), or mxc_gpio_init_gc()) fail, the error paths never unregister the chained handler, leaving a dangling handler that points at freed memory. Move the handler installation after all its dependencies are ready and after list_add_tail(), so the handler is never live while the data structures it touches are incomplete, and is never installed if probe fails.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Oct 27, 2026A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, CVE-2025-64394 · Other software · Veeam · reported by support@hackerone.comMedium 4.3
A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.
Product
Backup for Microsoft 365
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Oct 27, 2026A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticatedCVE-2026-111584 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.3
A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.
Product
TeamViewer Remote - Patch Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record teamviewer.com
Oct 27, 2026Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of AdvCVE-2026-111583 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.3
Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. An attacker can place a crafted installer options file that is processed by the Advanced Asset Management installer during service activation.
Product
Full Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record teamviewer.com
Oct 27, 2026A DLL loading vulnerability in the TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1 allows a local authenticated attacker CVE-2026-111582 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.3
A DLL loading vulnerability in the TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges. Exploitation requires user interaction.
Product
Remote Management - Monitoring
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record teamviewer.com
Oct 27, 2026Payment Integration Wompi: Does not verify the authenticity of incoming payment notifications on a stock installCVE-2026-103312 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to forge a notification and mark an arbitrary order as paid.
Product
Payment Integration Wompi
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Payment Integration Wompi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 26, 2026An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver installer DLL-loadingCVE-2026-107091 · Other software · reported by MITRE
An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver installer DLL-loading logic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huion.com gist.github.com
Oct 26, 2026An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary code via the Maltego Windows installer execuCVE-2026-107090 · Other software · reported by MITRE
An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary code via the Maltego Windows installer executable-resolution logic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record maltego.com gist.github.com
Oct 26, 2026Online Payments with iK Pay Gateway: Does not properly verify the authenticity of its payment gateway callback on a default installationCVE-2026-103306 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.
Product
Online Payments with iK Pay Gateway
Fixed in
3.0.4
What to do
Update Online Payments with iK Pay Gateway to 3.0.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026Duplicator: Does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5CVE-2026-115251 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.
Product
Duplicator
Fixed in
5.0.0
What to do
Update Duplicator to 5.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to CVE-2026-115503 · Other software · NationalSecurityAgency · reported by VulnCheckMedium 6.8
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.
Product
ghidra
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 22, 2026Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP eCVE-2026-115397 · Other software · NationalSecurityAgency · reported by VulnCheckMedium 6.8
Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesystem inodes, causing project writes and other processes to fail.
Product
ghidra
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 22, 2026Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engiCVE-2026-77156 · Other software · Checkmarx · reported by 596c5446-0ce5-4ba2-aa66-48b3b757a647Medium 6.3
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation. Exploitation required substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal. Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.
Product
github.com/checkmarx/ast-cli
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 22, 2026QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installatCVE-2017-20288 · Other software · QCubed · reported by VulnCheckMedium 5.1
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installation_path parameter. Attackers can craft GET requests to /assets/php/_devtools/installer/step_2.php with malicious installation_path values echoed unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Product
QCubed
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 21, 2026Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations.CVE-2026-114732 · Email & office · reported by MITREMedium 6.8
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org github.com
Oct 21, 2026In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app.CVE-2026-76305 · Other software · Splunk · reported by psirt@cisco.comMedium 6.5
In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source code and sensitive information. The vulnerability is possible because Splunk SOAR does not verify permission to view apps before it returns the app archive. For more information see Export or import an app (https://help.splunk.com/en/splunk-soar/soar-on-premises/develop-apps/8.4.0/develop-an-app-using-the-splunk-soar-app-wizard/export-or-import-an-app) and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
Product
Splunk SOAR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisory.splunk.com
Oct 21, 2026In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that Splunk SOAR displaysCVE-2026-76303 · Other software · Splunk · reported by psirt@cisco.comMedium 5.7
In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that Splunk SOAR displays in app documentation by installing an app. If another user who holds a role with permission to view apps opens the app documentation, Splunk SOAR could run that content in the browser of the user who opened the app documentation. With this access, the first user could access data and make changes that the user who opened the app documentation could make. The vulnerability is possible because Splunk SOAR does not sanitize app documentation content before it displays that content. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user that holds a role with the install_apps capability should not be able to exploit the vulnerability at will. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/7.1.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Add and configur
Product
Splunk SOAR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisory.splunk.com
Oct 21, 2026The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connecCVE-2026-105936 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint (/admin/v2/worker/connectors) and the deprecated functions connectors endpoint (/admin/v2/functions/connectors and /admin/v3/functions/connectors). When authorization is enabled, the worker connectors endpoint requires super-user access. The functions connectors endpoint, served both by the functions worker and by a broker running the functions worker, returns the same catalog without this check. As a result, when authentication and authorization are enabled, any authenticated client can read the connector catalog through the functions connectors endpoint, regardless of the permissions granted to its role and without super-user access. Unauthenticated requests are rejected unless anonymous access is configured with an anonymous user role. The catalog contains the connector type definitions installed in the functions worker's connectors directory: the connector name, its description, and the source, sink and configuration class names. It does not contain configured source or sink instances, their configuration
Product
Apache Pulsar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org pulsar.apache.org
Oct 20, 2026Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cCVE-2026-114119 · Other software · Best Practice Software · reported by VulnCheckCritical 9.3
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
Product
Bp Premier
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record def.ci-isac.org.au kb.bestpracticesoftware.com
Oct 20, 2026Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer).CVE-2026-91501 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.5
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager executes to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Product
Oracle Identity Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91330 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 3.3
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91329 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91327 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91326 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91325 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91315 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91314 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91313 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91312 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91311 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC).CVE-2026-91310 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91308 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91307 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91306 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91305 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.1
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91304 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91303 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-87323 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Product
JD Edwards EnterpriseOne Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a CVE-2026-113329 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Oct 20, 2026Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox vCVE-2026-113301 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Oct 20, 2026Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox viaCVE-2026-113261 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Oct 20, 2026Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandboCVE-2026-113224 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Oct 20, 2026Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox viCVE-2026-113217 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Oct 20, 2026Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandboCVE-2026-113169 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Oct 20, 2026Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox CVE-2026-113138 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Oct 20, 2026Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTCVE-2026-113080 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Oct 20, 2026Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTCVE-2026-113024 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Oct 20, 2026Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTCVE-2026-113021 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Oct 20, 2026Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI).CVE-2026-101851 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Installed Base accessible data as well as unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Product
Installed Base
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Installed Base product of Oracle E-Business Suite (component: HTML UI).CVE-2026-101850 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: HTML UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Installed Base. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Installed Base accessible data as well as unauthorized read access to a subset of Installed Base accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Product
Installed Base
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.