Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
241 results · page 1 of 5
Oct 27, 2026CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture.CVE-2026-116688 · Other software · ckeditor · reported by GitHubHigh 8.1
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.
- Product
- ckeditor5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture.CVE-2026-116687 · Other software · ckeditor · reported by GitHubLow 3.1
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.
- Product
- ckeditor5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro: Do not sanitise and escape a parameter before using it in a SQL statementCVE-2026-102499 · WordPress plugins & themes · reported by WPScanHigh 7.7
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.
- Product
- Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro
- Fixed in
- 7.37.0
- What to do
- Update Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro to 7.37.0 or newer.
Oct 18, 2026Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-96534 · WordPress plugins & themes · reported by WPScanHigh 7.7
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.
- Product
- Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro
- Fixed in
- 7.37.0
- What to do
- Update Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro to 7.37.0 or newer.
Oct 18, 2026Modern Events Calendar Lite: Does not verify that a user is authorized to edit the target post before updating itCVE-2026-110070 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.
- Product
- Modern Events Calendar Lite
- Fixed in
- 7.36.4
- What to do
- Update Modern Events Calendar Lite to 7.36.4 or newer.
Oct 18, 2026Modern Events Calendar Lite: Does not perform capabilityCVE-2026-110069 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.
- Product
- Modern Events Calendar Lite
- Fixed in
- 7.37.0
- What to do
- Update Modern Events Calendar Lite to 7.37.0 or newer.
Oct 14, 2026Hestia Control Panel is a lightweight and powerful control panel for the modern web.CVE-2026-108390 · Other software · hestiacp · reported by GitHubCritical 9.9
Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.
- Product
- hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Modern Events Calendar Lite: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-105067 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0.
- Product
- Modern Events Calendar Lite
- Fixed in
- 7.37.0
- What to do
- Update Modern Events Calendar Lite to 7.37.0 or newer.
Oct 13, 2026Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.CVE-2026-96855 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.CVE-2026-96850 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.CVE-2026-85833 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.CVE-2026-83697 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.CVE-2026-83657 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.CVE-2026-83656 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.CVE-2026-83654 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.CVE-2026-108396 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.CVE-2026-108133 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
- Product
- Windows Server 2022
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026FrankenPHP is a modern application server for PHP.CVE-2026-85733 · Websites & servers · php · reported by GitHubMedium 5.3
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5.
- Product
- frankenphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026FrankenPHP is a modern application server for PHP.CVE-2026-82416 · Websites & servers · php · reported by GitHubHigh 7.7
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5.
- Product
- frankenphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Dragonfly is an in-memory data store built for modern application workloads.CVE-2026-104192 · Other software · dragonflydb · reported by GitHubCritical 9.6
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.
- Product
- dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by reCVE-2026-109380 · Other software · ayuhito · reported by VulnCheckHigh 8.7
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries.
- Product
- modern-tar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures.CVE-2026-107375 · Other software · jhipster · reported by GitHubHigh 8.8
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request parameter from paginated entity-list endpoints into createOrderByFields in generators/spring-boot/generators/data-relational/templates/src/main/java/package/repository/EntityManager_reactive.java.ejs. The generated code renders these properties into the SQL ORDER BY clause without validation or quoting, and the R2DBC simple query protocol can execute additional statements separated by semicolons. A normal authenticated user can consequently read sensitive tables, modify or delete data, or drop tables, while non-reactive JPA applications and NoSQL backends are outside this root cause. This issue is fixed in 9.4.0.
- Product
- generator-jhipster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures.CVE-2026-107303 · Other software · jhipster · reported by GitHubHigh 7.6
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return them through generated REST endpoints, and pass them to the generated openFile helper in generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs. The helper uses the returned ContentType as the browser Blob MIME type and opens an object URL, so a normal authenticated user with write access to a Blob-bearing entity can store active HTML or SVG content that may execute under the application origin when a privileged user opens it. Exploitability depends on the generated application's content security policy and target-browser Blob behavior. This issue is fixed in generator-jhipster 9.4.0 and react-jhipster 1.1.0.
- Product
- generator-jhipster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attCVE-2026-93642 · Email & office · Zimbra · reported by cve@rapid7.comCritical 9.3
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
- Product
- Zimbra Collaboration Suite (ZCS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Logto is the modern, open-source auth infrastructure for SaaS and AI apps.CVE-2026-63203 · Other software · logto-io · reported by GitHubHigh 7.6
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterprise SSO provider access tokens through GET /api/my-account/identities/{target}/access-token or GET /api/my-account/sso-identities/{connectorId}/access-token. The handlers authenticate the user but do not require the identities scope that protects neighboring identity-detail operations, bypassing the intended Account API consent boundary. Exploitation requires federated token-set storage to be enabled and the affected user to have authenticated through a supported connector. A low-trust application can use the disclosed provider token against upstream APIs within that token's granted scopes. This issue is fixed in version 1.42.0.
- Product
- logto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Logto is the modern, open-source auth infrastructure for SaaS and AI apps.CVE-2026-56739 · Other software · logto-io · reported by GitHubHigh 8.5
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.43.0, Logto fetches administrator-controlled outbound destinations without validating the address used for the connection. Webhook delivery in packages/core/src/libraries/hook/utils.ts can reach special-use and cloud metadata addresses. Custom OAuth2 connectors can use an attacker-selected userInfoEndpoint and forward the OAuth access token in the Authorization header, while OIDC connectors can fetch an attacker-selected jwksUri. The affected operations require tenant administrative configuration access, but they cross the server's network boundary and can expose internal data or upstream provider credentials. This issue is fixed in version 1.43.0.
- Product
- logto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026TS3 Manager is modern web interface for maintaining Teamspeak3 servers.CVE-2026-54253 · Other software · joni1802 · reported by GitHubHigh 8.2
TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connect(port, host) and returns the resulting error.message through res.status(400).send(error.message) as text/html without a Content Security Policy. When a logged-in operator follows a crafted top-level link, the reflected value executes in the manager origin. The token cookie set in packages/ui/src/store/modules/query.js lacks HttpOnly, Secure, and an explicit SameSite attribute, allowing the script to read the token and call the autofillform event in packages/server/socket.js. autofillform returns the decoded JWT, including the cleartext ServerQuery password, enabling operator-session hijacking and control of the managed TeamSpeak server when the operator uses administrative ServerQuery credentials. A valid operator session and user interaction are required. This issue is fixed in 2.2.6.
- Product
- ts3-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs.CVE-2026-52724 · Other software · kumahq · reported by GitHubMedium 5.8
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.
- Product
- kuma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs.CVE-2026-50166 · Other software · kumahq · reported by GitHubMedium 5.5
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens over the unverified connection. An attacker on the network path can intercept user or administrator API tokens and act against the control plane as the compromised user. The default local profile is unaffected because it uses plain HTTP. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.
- Product
- kuma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026EasyAdmin is a fast and modern admin generator for Symfony applications.CVE-2026-54087 · Other software · EasyCorp · reported by GitHubHigh 7.6
EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker with access to an affected form can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin when the file is opened from the backend. Exploitation requires a privilege gap between the uploader and viewer. The issue can expose session or CSRF tokens and enable privilege escalation, but does not permit PHP or PHTML code execution because Symfony guessExtension does not produce those stored extensions. This issue is fixed in version 5.0.13.
- Product
- EasyAdminBundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.CVE-2026-73022 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.CVE-2026-73003 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Windows Modern Execution Server allows an authorized attacker to elevate privileges locally.CVE-2026-72963 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Modern Execution Server allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.CVE-2026-70577 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to bypass a security feature locally.CVE-2026-69674 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to bypass a security feature locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges over a network.CVE-2026-69460 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges over a network.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Missing authorization in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.CVE-2026-69377 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Missing authorization in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / CVE-2026-53611 · Other software · AS203038 · reported by GitHubCritical 9.8
Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC (ConnectRPC) API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there is an OS Command Injection vulnerability resulting from an unanchored regular expression in the input validation layer. This issue has been patched in version 1.3.5.
- Product
- looking-glass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026EasyAdmin is a fast and modern admin generator for Symfony applications.CVE-2026-81892 · Other software · EasyCorp · reported by GitHubHigh 8.1
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.
- Product
- EasyAdminBundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Protego is a pure-Python robots.txt parser with support for modern conventions.CVE-2026-55520 · Other software · scrapy · reported by GitHubHigh 7.1
Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URLPattern._prepare_pattern_for_regex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks creates exponential backtracking. After protego.Protego.parse processes a crafted robots.txt file, protego.Protego.can_fetch can spend an attacker-controlled period matching a near-miss URL and deny service to the crawler. The vulnerable path is src/protego/_urlpattern.py in the _URLPattern match logic. This issue is fixed in version 0.6.2.
- Product
- protego
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026NanaZip is the 7-Zip derivative intended for the modern Windows experience.CVE-2026-54616 · Other software · M2Team · reported by GitHubHigh 7.1
NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the _cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0.
- Product
- NanaZip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Logto is the modern, open-source auth infrastructure for SaaS and AI apps.CVE-2026-63188 · Other software · logto-io · reported by GitHubHigh 8.7
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through packages/tunnel/src/commands/tunnel/utils.ts using path.join(staticPath, request.url) and then fs.open(requestPath, "r") without URL normalization or a containment check. When --experience-path was enabled and the tunnel port was reachable, an unauthenticated requester could send a path containing ../ to createStaticFileProxy and read files outside the configured static directory that were readable by the logto-tunnel process. The service used server.listen(port), which could expose the tunnel to other hosts depending on the platform and deployment. This issue is fixed in version 0.3.9.
- Product
- logto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Logto is the modern, open-source auth infrastructure for SaaS and AI apps.CVE-2026-63187 · Other software · logto-io · reported by GitHubMedium 6.3
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pull_request.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.
- Product
- logto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Logto is the modern, open-source auth infrastructure for SaaS and AI apps.CVE-2026-62317 · Other software · logto-io · reported by GitHubHigh 7.5
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled. The permissive emailRegEx accepted multiple at signs and regular expression metacharacters, and POST /api/experience/verification/verification-code could therefore cause catastrophic backtracking in subaddressingRegex.test(email). The resulting event-loop stall could make authentication, token issuance, SSO, and the administrative console unavailable. This issue is fixed in version 1.41.0.
- Product
- logto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage.CVE-2026-50167 · Other software · kurrier-org · reported by GitHubMedium 5.3
Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use another account's identifiers to read and enumerate webhook and identity resources belonging to that account through apps/worker/server/routes/api/kurrier/webhooks/[id].get.ts, apps/worker/server/routes/api/kurrier/webhooks/index.get.ts, apps/worker/server/routes/api/kurrier/identities/[id].get.ts, and apps/worker/server/routes/api/kurrier/identities/index.get.ts. Anonymous requests and invalid API keys were rejected, and cross-user modification operations were blocked, but affected GET and list operations could expose another user's resource metadata. This issue is fixed in version 1.2.4.
- Product
- kurrier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Dragonfly is an in-memory data store built for modern application workloads.CVE-2026-62357 · Other software · dragonflydb · reported by GitHubHigh 8.8
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeof(int64_t) overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the unbounded dimensions, which allows an unauthenticated remote client to corrupt or disclose adjacent heap memory and crash the server. This issue is fixed in version 1.40.0.
- Product
- dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.CVE-2026-73339 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 11, 2026Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.CVE-2026-62707 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask.CVE-2026-14587 · Other software · neo4j · reported by 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6Medium 5.5
Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for more bytes instead of rejecting the protocol message and closing the channel. Because the same unread bytes remain at the front of the decoder buffer, appending a terminating byte later does not recover the connection. The decoder re-reads the same first 32 continuation bytes, returns without producing a handshake-finalization message, and leaves the channel open. This can be triggered before authentication by any client that can reach the Bolt connector.
- Product
- Enterprise Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite: Do not sanitise and escape a request parameter before using it in a SQL statementCVE-2026-11349 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.
- Product
- Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite
- Fixed in
- 7.34.0
- What to do
- Update Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite to 7.34.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.