Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,213 results · page 1 of 45
Nov 13, 2026NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType paCVE-2026-129171 · Other software · likaia · reported by VulnCheckCritical 9.3
NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType parameters of /api/stats/:type. Attackers can close the quoted table-name identifier and use error-based output to read database contents, and read or write server files via PostgreSQL superuser functions.
- Product
- NginxPulse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2026Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via clieCVE-2026-124279 · Other software · elixir-grpc · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.2
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests. The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with max_body_size only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all. This issue affects grpc_server: from 1.0.0 before 1.1.0.
- Product
- grpc_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Nov 13, 2026Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging ContCVE-2026-126938 · Other software · diced · reported by VulnCheckHigh 7.1
Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the server to create oversized files and exhaust disk space.
- Product
- zipline
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Nov 13, 2026OpenEMR before 8.5.0 contains an access control flaw in get_claim_file.php: with location=tmp, it serves any file in the shared temporary directory without veriCVE-2026-126417 · Other software · openemr · reported by VulnCheckMedium 6
OpenEMR before 8.5.0 contains an access control flaw in get_claim_file.php: with location=tmp, it serves any file in the shared temporary directory without verifying the file is a claim for the caller. Users with acct/eob or acct/bill write access can request key=ccda.xml to download the most recently validated patient's complete C-CDA clinical document.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Nov 13, 2026Memory overflow / improper handling in GSLB and geolocation (MEP, static-proximity, config-sync) can lead to unpredictable or erroneous behavior or Denial of SeCVE-2026-120861 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5High 8.7
Memory overflow / improper handling in GSLB and geolocation (MEP, static-proximity, config-sync) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
- Product
- NetScaler ADC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2026A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive memory allocations by sending a small TCP pCVE-2026-91141 · Other software · COVESA · reported by cret@cert.org
A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive memory allocations by sending a small TCP packet with a large, attacker-declared SOME/IP length field. This can lead to immediate service termination via OOM-kill on memory-constrained systems or total host memory exhaustion through repeated connections.
- Product
- vSomeIp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbiackr0se.github.iokb.cert.org
Nov 12, 2026A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's native library loading routine wilCVE-2026-126823 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.3
A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's native library loading routine will accept and load without verifying its origin. Loading the driver class in a Java application may then run code of that user's choosing inside the application process, which may result in disclosure or alteration of data held by that process or in the process becoming unavailable.
- Product
- Atlas SQL JDBC Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2026Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actorCVE-2026-127119 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 5.9
Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket. To remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use.
- Product
- aws-sdk-pandas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Nov 11, 2026A allocation of resources without limits or throttling vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10CVE-2026-126244 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.5
A allocation of resources without limits or throttling vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to exhaust system resources, potentially resulting in a denial of service (DoS).
- Product
- FortiAuthenticator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Nov 11, 2026A memory allocation with excessive size value vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.CVE-2026-126165 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.5
A memory allocation with excessive size value vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to cause a denial of service via a specially crafted attachment delivered over SMTP.
- Product
- FortiMail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Nov 11, 2026Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to exhaust the server's CVE-2026-126613 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 7.5
Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to exhaust the server's memory and hold its threads, making mail delivery, the REST API and the webmail unavailable. The reader built a tree of values far larger than the text it read, copying each value into every level above it, and set no bound on the number of values, so a single JSON document of many small values, within the 16 MB the server reads, raised the service's memory by about 2 GB and held one thread for seconds to minutes. From 6.3.4 a remote unauthenticated attacker reaches the reader by mailing such a document as a TLS-RPT report, up to 16 MB once decompressed, to a hosted domain's report mailbox, where an administrator has set one; it is read on a mail delivery thread (ten by default), and those threads deliver all mail, local and outbound. From 6.3.4 it is also reached without an account through the reply to a password-protected message, with the message's link alone, where the REST API is on (it is off by default) and a public base URL for such links is set; and by any account, from 6.3.2 through the webmail's send and draft rou
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible way to modify coprocessor instruction and data memory from non-secure software due to an insecure default value.CVE-2026-95404 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.7
In multiple locations, there is a possible way to modify coprocessor instruction and data memory from non-secure software due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible way to trigger an out of bounds write in the shared memory tracking bitmap due to a missing bounds check.CVE-2026-95403 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.4
In multiple locations, there is a possible way to trigger an out of bounds write in the shared memory tracking bitmap due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible way to trigger an out of bounds read via direct memory access in video decoder firmware due to a logic error.CVE-2026-59624 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 4
In multiple locations, there is a possible way to trigger an out of bounds read via direct memory access in video decoder firmware due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible way to trigger an out of bounds read and temporary denial of service due to improper input validation.CVE-2026-59613 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.5
In multiple locations, there is a possible way to trigger an out of bounds read and temporary denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible way to trigger a temporary denial of service via an integer overflow trap due to improper input validation.CVE-2026-59611 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.5
In multiple locations, there is a possible way to trigger a temporary denial of service via an integer overflow trap due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible way to trigger an unbounded loop in video decoder firmware due to a logic error.CVE-2026-59604 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.2
In multiple locations, there is a possible way to trigger an unbounded loop in video decoder firmware due to a logic error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible way to recover cryptographic keys and forge authentication tags due to improperly used crypto.CVE-2026-59586 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 4
In multiple locations, there is a possible way to recover cryptographic keys and forge authentication tags due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a missing permission check.CVE-2026-58808 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comLow 2.3
In multiple locations, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible way to zero arbitrary secure memory via unvalidated image body addresses due to a missing bounds check.CVE-2026-58805 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.7
In multiple locations, there is a possible way to zero arbitrary secure memory via unvalidated image body addresses due to a missing bounds check. This could lead to physical escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible denial of service due to a logic error in the code.CVE-2026-58783 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 4.4
In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible denial of service due to a logic error in the code.CVE-2026-58782 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.2
In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check.CVE-2026-58780 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 9.8
In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible permission bypass due to a logic error in the code.CVE-2026-58779 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.7
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible use-after-free due to a race condition.CVE-2026-58778 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.4
In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible out-of-bounds read due to a missing bounds check.CVE-2026-58769 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comLow 2.3
In multiple locations, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible out-of-bounds write due to a heap buffer overflow.CVE-2026-58696 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.7
In multiple locations, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible out-of-bounds write due to an integer overflow.CVE-2026-58681 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 9.8
In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible way to corrupt host allocator metadata in shared memory due to memory corruption.CVE-2026-56995 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.7
In multiple locations, there is a possible way to corrupt host allocator metadata in shared memory due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible way to modify authenticated coprocessor firmware in shared memory before loading due to a race condition.CVE-2026-56949 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.4
In multiple locations, there is a possible way to modify authenticated coprocessor firmware in shared memory before loading due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle due to an incorrect bounds check.CVE-2026-56943 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comLow 2.3
In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible way to trigger an out of bounds read and write in shared memory due to an incorrect bounds check.CVE-2026-56910 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.4
In multiple locations, there is a possible way to trigger an out of bounds read and write in shared memory due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible information disclosure due to a logic error in the code.CVE-2026-56902 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 4
In multiple locations, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible use-after-free due to a logic error in the code.CVE-2026-55335 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 9.8
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026In multiple locations, there is a possible way to bypass key authorization policies during wrapped key import due to a logic error.CVE-2026-0175 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.4
In multiple locations, there is a possible way to bypass key authorization policies during wrapped key import due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-118750 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft.AspNetCore.WebUtilities
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-118748 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- Product
- .NET 11.0 installed on Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2026A high privileged remote attacker can upload arbitrary files to a guessable location.CVE-2026-60045 · Other software · MB connect line · reported by info@cert.vde.comMedium 6.9
A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a loss of availability and might be chained with other vulnerabilities.
- Product
- mbCONNECT24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Nov 10, 2026Cargo Shipping Location for WooCommerce: Does not properly restrict access to a REST API endpoint that updates order shipment statusesCVE-2026-106025 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and shipment metadata.
- Product
- Cargo Shipping Location for WooCommerce
- Fixed in
- 6.0
- What to do
- Update Cargo Shipping Location for WooCommerce to 6.0 or newer.
Nov 10, 2026Zion Builder: Does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own originCVE-2026-104676 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own origin, allowing authenticated users with the Author role or above to upload a crafted SVG containing JavaScript that executes in the browser of anyone who opens the file.
- Product
- Zion Builder
- Affected
- up to 3.6.17
- What to do
- Affects up to 3.6.17. Update Zion Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2026SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests.CVE-2026-120010 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.5
SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in affected functionality. Successful exploitation causes the component to abort and remain unavailable until it is restarted by the framework, resulting in a high impact on availability of the system. There is no impact on confidentiality and integrity of the application.
- Product
- SAP NetWeaver Application Server (SAP Message Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in sbg_read_header() in libavformat/sbgdec.c that derives an unbounded default fraCVE-2026-125226 · Other software · FFmpeg · reported by VulnCheckMedium 6.8
FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in sbg_read_header() in libavformat/sbgdec.c that derives an unbounded default frame size from the script's sample rate. Attackers can supply a crafted SBaGen script declaring a very high -r sample rate so the wavesynth decoder allocates enormous audio frames, exhausting memory and causing denial of service.
- Product
- FFmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.ffmpeg.orggithub.com
Nov 9, 2026FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in the Interplay ACM decoder that allows attackers to exhaust memory via an attackCVE-2026-125207 · Other software · FFmpeg · reported by VulnCheckMedium 6.8
FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in the Interplay ACM decoder that allows attackers to exhaust memory via an attacker-controlled block size. Attackers can supply a crafted ACM file with maximum level and row count in extradata, making decode_init() allocate nearly a gigabyte and deny service.
- Product
- FFmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.ffmpeg.orggithub.com
Nov 9, 2026FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1_frame_merge bitstream filter that allows attackers to exhaust memory by neCVE-2026-125205 · Other software · FFmpeg · reported by VulnCheckMedium 6.8
FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1_frame_merge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file opened by the AV1 OBU or Annex B demuxers, forcing unlimited OBU buffering per temporal unit and causing denial of service.
- Product
- FFmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.ffmpeg.orggithub.com
Nov 9, 2026FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing manCVE-2026-125180 · Other software · FFmpeg · reported by VulnCheckMedium 6.8
FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF block in TIFF, JPEG, PNG or WebP images to trigger quadratic memory allocation, causing denial of service in decoding applications.
- Product
- FFmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.ffmpeg.orggithub.com
Nov 9, 2026FFmpeg through 9.0.2 contains an infinite loop vulnerability in bit_allocation() in libavcodec/imc.c that allows attackers to hang decoding by supplying audio bCVE-2026-125073 · Other software · FFmpeg · reported by VulnCheckMedium 6.8
FFmpeg through 9.0.2 contains an infinite loop vulnerability in bit_allocation() in libavcodec/imc.c that allows attackers to hang decoding by supplying audio blocks with a negative bit budget. Attackers can craft IMC or IAC audio files that drive freebits negative, causing the reduction loop to never terminate and consuming 100% CPU.
- Product
- FFmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.ffmpeg.orggithub.com
Nov 9, 2026NASA JPL ION-DTN 2.1.0 through 4.2.0 contains a heap buffer under-allocation vulnerability in the Asynchronous Message Service daemon (amsd) that allows a rogueCVE-2026-124000 · Other software · nasa-jpl · reported by VulnCheckMedium 6.9
NASA JPL ION-DTN 2.1.0 through 4.2.0 contains a heap buffer under-allocation vulnerability in the Asynchronous Message Service daemon (amsd) that allows a rogue or misconfigured peer to trigger an out-of-bounds write by sending crafted Meta-AMS (MAMS) configuration management messages that are processed without cryptographic authentication. Attackers can exploit the insufficient buffer size calculation for the internal state-event object to crash the active Configuration Server thread, causing a denial of service and potentially destabilizing subsequent shared-memory allocations in amsd.
- Product
- ION-DTN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026iubenda: Allocation of Resources Without Limits or ThrottlingCVE-2026-120854 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Allocation of Resources Without Limits or Throttling vulnerability in iubenda iubenda iubenda-cookie-law-solution allows HTTP DoS.This issue affects iubenda: from n/a through 3.13.6.
- Product
- iubenda
- Affected
- up to 3.13.6
- What to do
- Affects up to 3.13.6. Update iubenda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2026Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.CVE-2026-118450 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 5.9
Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.
- Product
- Venere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java.CVE-2026-123770 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not apply, and multipart temporary files were not deleted. An unauthenticated caller could exhaust memory or disk. Version 2.0.2 bounds these bodies with configurable limits and deletes temporary files. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
- Product
- Apache Axis2/Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaxis.apache.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.