Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,899 results · page 1 of 138
Oct 28, 2026Essential Addons for Elementor: Does not apply its administrator approval requirement to accounts registered through its email one-time-password flowCVE-2026-110508 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.
- Product
- Essential Addons for Elementor
- Fixed in
- 6.8.7
- What to do
- Update Essential Addons for Elementor to 6.8.7 or newer.
Oct 27, 2026CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disCVE-2015-20129 · Other software · CrushFTP · reported by VulnCheckHigh 8.6
CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.
- Product
- CrushFTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcrushftp.comexploit-db.com
Oct 27, 2026C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administratCVE-2014-125138 · Other software · C97net · reported by VulnCheckHigh 8.7
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.
- Product
- qEngine CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Oct 27, 2026Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the curreCVE-2013-20008 · Network & remote access · Linksys · reported by VulnCheckHigh 7
Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control.
- Product
- WAG200G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.coms3cur1ty.de
Oct 27, 2026Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings.CVE-2026-16491 · Other software · Grafana · reported by security@grafana.comMedium 6.5
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.
- Product
- Grafana Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have tCVE-2026-82986 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.6
The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.
- Product
- Tables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA vCVE-2026-107671 · Other software · Veeam · reported by support@hackerone.comHigh 8.5
A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.
- Product
- ONE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileCVE-2026-106077 · Other software · Veeam · reported by support@hackerone.comHigh 8.3
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
- Product
- Backup for Microsoft 365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcodedCVE-2026-117564 · Other software · buqiyuan · reported by VulnCheckCritical 9.3
nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.
- Product
- nest-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsaCVE-2026-117560 · Other software · atxp · reported by VulnCheckHigh 8.5
ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick substitutions into parameters like message_id, subject, or query, running commands as the user.
- Product
- gemini-cli-extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check onlyCVE-2026-117536 · Other software · redaxo · reported by VulnCheckHigh 8.6
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 27, 2026In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.CVE-2026-117466 · Other software · Octopus Deploy · reported by security@octopus.comHigh 8.6
In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.com
Oct 27, 2026This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMCCVE-2026-65213 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411Medium 6.6
This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC
- Product
- MBD-X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.CVE-2026-65211 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411High 7.2
This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.
- Product
- MBD-X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.CVE-2026-65220 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411High 8.8
A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.
- Product
- MBD-X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI manaCVE-2026-65210 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411Medium 4.9
This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.
- Product
- MBD-X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated adminiCVE-2026-116827 · Other software · YesWiki · reported by VulnCheckHigh 8.2
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension check with a query-string suffix or redirects to fetch cloud metadata credentials, internal services, or local files via file://, with responses stored in the web-accessible files/ directory.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 26, 2026YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to makeCVE-2026-116826 · Other software · YesWiki · reported by VulnCheckHigh 8.2
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 26, 2026Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding.CVE-2026-70382 · Other software · WolfVision · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 5.1
Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.
- Product
- Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026An access-control vulnerability has been identified in the web server configuration.CVE-2026-70381 · Other software · WolfVision · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 6.9
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.
- Product
- Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service.CVE-2026-70380 · Other software · WolfVision · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 6.9
A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthenticated attacker with network access to the MICE service could consume available connection capacity, preventing legitimate users from establishing MICE-based Miracast connections while the condition persists. Miracast P2P is not affected. MICE is disabled in the default configuration and must be explicitly enabled by the customer. On most devices, Miracast P2P is available independently of MICE, but a complete disruption of Miracast can occur on some devices when WLAN is configured for Infrastructure mode.
- Product
- Cynap Pro, Cynap Core Pro, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFCVE-2026-116638 · Other software · reported by MITRE
The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be able to leverage WinRE-related boot mechanisms to circumvent firmware protections and gain unauthorized access to system resources.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximuCVE-2026-72758 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 7.5
When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.
- Product
- Routinator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpoint request which allows a System AdminiCVE-2026-93848 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.7
Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpoint request which allows a System Administrator to determine whether internal addresses and ports are reachable from the server via an unauthenticated login request that triggers the discovery fetch.. Mattermost Advisory ID: MMSA-2026-00774
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges.CVE-2026-3322 · Other software · Lobster DATA GmbH · reported by 23637b5d-af4c-4cf9-b8f6-deb7fd0f8423Medium 5.6
Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.
- Product
- Lobster_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschutzwerk.comseclists.org
Oct 26, 2026Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass theCVE-2026-116219 · Other software · Dolibarr · reported by VulnCheckHigh 8.6
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.
- Product
- dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax).CVE-2026-115191 · Other software · reported by security@mautic.orgHigh 7.1
A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this, regardless of the role or permissions assigned to the account. Using blind (boolean-based or time-based) techniques, the attacker can run arbitrary SQL queries against the Mautic database and read any data the Mautic database user can access, including Mautic user accounts with email addresses and password hashes, contact data, and campaign and email content.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access CVE-2026-113345 · Other software · Ministry of Land, Infrastructure, Transport and Tourism, Japan · reported by vultures@jpcert.or.jpHigh 8.5
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.
- Product
- Electronic delivery item Inspection Support System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration eCVE-2026-116197 · Other software · edgelesssys · reported by VulnCheckLow 2.1
Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.
- Product
- contrast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-boundinCVE-2026-116142 · Other software · ImageMagick · reported by VulnCheckMedium 4.8
ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers can supply a crafted image that triggers the over-read during minimum-bounding-box output, causing crashes or exposing adjacent heap memory.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 24, 2026GeoDirectory: Does not properly escape administrator-defined text before writing it into a generated PHP file in its own folderCVE-2026-113673 · WordPress plugins & themes · reported by WPScanHigh 7.2
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.
- Product
- GeoDirectory
- Fixed in
- 2.8.194
- What to do
- Update GeoDirectory to 2.8.194 or newer.
Oct 23, 2026A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite gCVE-2026-93639 · Email & office · Zimbra · reported by cve@rapid7.comHigh 8.7
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise additionally requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comrapid7.com
Oct 23, 2026The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user CVE-2026-4951 · Other software · VertiGIS Ltd. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 5.1
The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user groups). The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL. JavaScript code placed in this parameter is executed in the victim's browser. An unauthenticated attacker who knows the URL structure can craft a link that contains script code. The code runs if a privileged user who is currently logged into the portal opens the link. Because administrative users can change the passwords of other users, including administrators, without entering the old password, an attacker may be able to take over accounts or lock out other users. Version 7.0.8.6, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.
- Product
- WebOrderSystem (KundenManager)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies (user groups).CVE-2026-4950 · Other software · VertiGIS Ltd. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 4.8
The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies (user groups). User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and executed in the browser of any other privileged user who opens the edited user entry or the user overview of the corresponding user group. An authenticated attacker with access to the portal can use this to run script code in the session of other portal users. Version 7.0.8.6, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.
- Product
- WebOrderSystem (KundenManager)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Download Monitor: Does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisiteCVE-2026-112219 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and have the Download Monitor WordPress plugin before 5.3.5 serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors; single-site installations are unaffected.
- Product
- Download Monitor
- Fixed in
- 5.3.5
- What to do
- Update Download Monitor to 5.3.5 or newer.
Oct 23, 2026Essential Addons for Elementor: Does not verify that an administrator may manage the specific user accounts targeted by its login-approval featureCVE-2026-110537 · WordPress plugins & themes · reported by WPScanLow 3.8
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.
- Product
- Essential Addons for Elementor
- Fixed in
- 6.8.7
- What to do
- Update Essential Addons for Elementor to 6.8.7 or newer.
Oct 22, 2026A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service.CVE-2026-95720 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.4
A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026An arbitrary file deletion vulnerability exists in the command line interface of AOS-10 that could allow an authenticated attacker with administrative privilegeCVE-2026-95719 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.9
An arbitrary file deletion vulnerability exists in the command line interface of AOS-10 that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting normal operation of the affected device.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative atCVE-2026-114486 · Other software · Devolutions · reported by security@devolutions.net
Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the gateway token.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modifyCVE-2026-115253 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3High 7.3
An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.
- Product
- WatchGuard Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Photo Engine (Media Organizer & Lightroom): Does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboardCVE-2026-111971 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Photo Engine (Media Organizer & Lightroom)
- Fixed in
- 6.5.8
- What to do
- Update Photo Engine (Media Organizer & Lightroom) to 6.5.8 or newer.
Oct 21, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass.CVE-2026-96387 · Websites & servers · reported by mlhess@drupal.orgLow 3.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accountCVE-2026-114633 · Other software · WWBN · reported by VulnCheckHigh 7
WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submittiCVE-2026-29001 · Other software · tastyigniter · reported by VulnCheckHigh 8.6
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten.
- Product
- TastyIgniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 21, 2026Apache Pulsar Manager is a web console for administering Apache Pulsar clusters.CVE-2026-105944 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 10
Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the following security issues: - The operation for creating the initial administrator (superuser) account is available without authentication, and it remains available after the instance has been initialized. Anyone who can reach Pulsar Manager can create an additional administrator account at any time and log in with it. This issue affects versions 0.3.0 and later. - Requests to the Pulsar admin API that Pulsar Manager proxies to the configured Pulsar cluster are not subject to Pulsar Manager's authentication. Version 0.2.0 checks the caller's permissions for some of these requests, but not for all of them. An unauthenticated user can therefore use Pulsar Manager to send requests to the Pulsar admin API, which the cluster processes with the credential configured in Pulsar Manager. - The destination of a proxied request can be chosen by the requester, and Pulsar Manager attaches its configured Puls
- Product
- Apache Pulsar Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgpulsar.apache.org
Oct 21, 2026Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_required namespace policyCVE-2026-105933 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 2.3
Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_required namespace policy. When this policy is set, the broker rejects messages that are published without encryption. When the broker loads a persistent topic, it reads the namespace policies and the topic-level policies as part of topic initialization. If a step of this initialization fails, for example because of an error reading from the metadata store, a failure loading the topic-level policies or a failure in a later initialization step, the broker logs a warning, disables the encryption requirement for that topic, and completes the topic load as if it had succeeded. The topic is then served with encryption_required not enforced, even though the namespace policy requires it. Topic-level policies that could not be loaded are also not applied. While the encryption requirement is not enforced, an authenticated client with permission to produce to the affected topic can publish messages that are not encrypted, and the broker accepts and stores them. This applies both to producers created after the topic was loaded and to producers that were alre
- Product
- Apache Pulsar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgpulsar.apache.org
Oct 21, 2026The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions.CVE-2026-105931 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 2.3
The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most of the read endpoints of this API verify only that the request is authenticated and that the broker serves the requested topic or transaction coordinator. They do not check whether the caller is permitted to access the tenant, namespace or topic whose data is returned. The endpoints that modify state, which abort a transaction or scale the transaction coordinators, correctly require super-user access and are not affected. As a result, any authenticated user, including one that has been granted no permissions, can read transaction coordinator and transaction information belonging to other tenants. This includes the list of transaction coordinators with the broker service URLs that serve them, transaction coordinator statistics and internal statistics, transaction metadata including the names of the topics and subscriptions a transaction involves and the principal that opened it, the list of long-running transactions on a transaction coordinator, transaction buffer and pending acknowledgement statistics and internal statistics f
- Product
- Apache Pulsar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgpulsar.apache.org
Oct 21, 2026gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by suppCVE-2026-114492 · Other software · flipped-aurora · reported by VulnCheckHigh 7
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.
- Product
- gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint.CVE-2026-114129 · Other software · uhop · reported by GitHubMedium 6.2
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack grows with unbounded object or array nesting, a document nested to depth D causes D joins whose cost grows with the current depth, resulting in quadratic CPU consumption on the single-threaded event loop. The join occurs before the rule match decision, so the attacker does not need to know the target schema. Consumers using only function filters or no rules are not affected. A crafted nested document can stall all concurrent work in a process that feeds it to an affected FlexAssembler. This issue is fixed in 3.7.0, which adds a default maximum depth.
- Product
- stream-json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with CVE-2026-114490 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 7.8
Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API's server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain's accounts and mail, rename any domain, map a domain alias onto any, write the server's settings and secrets, and create further server-administrator accounts. The COM API's domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account's own domain administer that domain's ordinary accounts over COM. An account holding servera
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.