Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6 results
Oct 7, 2026This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality.CVE-2026-107104 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code, manipulate application data or perform other unintended actions on the targeted system.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint.CVE-2026-107103 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation of this vulnerability could allow the attacker to perform SQL injection attacks on the targeted system.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint.CVE-2026-107102 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an authenticated session for an arbitrary user without valid payment verification. Successful exploitation of this vulnerability could allow the attacker to bypass authentication and gain unauthorized access to other user accounts on the targeted system.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory.CVE-2026-84149 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.2
This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files, which could allow reconstruction of the application's source code.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint.CVE-2026-84148 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.2
This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating parameter which could lead to exposure of sensitive information belonging to other users on the targeted system.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint.CVE-2026-84147 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 10
This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by uploading arbitrary files to a web accessible directory on the targeted system Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code and compromise the targeted system.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.