Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,994 results · page 1 of 80
Oct 28, 2026Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expectedCVE-2025-14260 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8High 8.3
Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.
- Product
- WSO2 API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Oct 28, 2026Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a mCVE-2026-106484 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.4
Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file. (Chromium security severity: Medium)
- Product
- chrome-devtools-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability.CVE-2026-118615 · Other software · Ultralytics · reported by zdi-disclosures@trendmicro.comHigh 7.8
Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the torch_safe_load function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30122.
- Product
- Ultralytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2026-118613 · Other software · Ultralytics · reported by zdi-disclosures@trendmicro.comHigh 7.8
Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the torch_load function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-29652.
- Product
- Ultralytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their confiCVE-2026-117624 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.com
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags.CVE-2026-118173 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 6.1
MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes carried tags belonging to a required taxonomy (for example, TLP), the guard only verified that at least one tag of that taxonomy matched the configured allowed list. It did not verify that every tag of the required taxonomy present on the event or attribute was in the allowed list. As a result, an event or attribute could simultaneously carry an allowed tag (e.g., tlp:clear) and a non-allowed tag (e.g., tlp:red or tlp:amber) and still pass the guard's policy check. This allowed data marked with a higher classification or sensitivity level to be distributed through feeds configured to only distribute lower-classification data, effectively bypassing the intended data-handling restrictions. The vulnerability affected both event-level and attribute-level tag validation, including attributes nested within objects and shadow attributes. An attacker with the ability to author or modify MISP events in a feed source could include non-allowed taxonomy tags alongside allowed ones to exfiltrate more sensitive data to fee
- Product
- misp-guard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed a compression bomb vulnerability in Enforce.CVE-2026-116662 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.5
Tanium addressed a compression bomb vulnerability in Enforce.
- Product
- Enforce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed an improper access controls vulnerability in Enforce.CVE-2026-116660 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.3
Tanium addressed an improper access controls vulnerability in Enforce.
- Product
- Enforce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.CVE-2026-116659 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 4.3
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
- Product
- Enforce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed a denial of service vulnerability in Enforce.CVE-2026-116658 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed a denial of service vulnerability in Enforce.
- Product
- Enforce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed a denial of service vulnerability in Enforce.CVE-2026-116657 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 5.3
Tanium addressed a denial of service vulnerability in Enforce.
- Product
- Enforce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.CVE-2026-116656 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.5
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
- Product
- Enforce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed an improper output sanitization vulnerability in Enforce.CVE-2026-116649 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.1
Tanium addressed an improper output sanitization vulnerability in Enforce.
- Product
- Enforce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process allows an authenticated mobile VPN user to create a denial oCVE-2026-113881 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 6.1
A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process allows an authenticated mobile VPN user to create a denial of service condition and potentially execute arbitrary code as an unprivileged process by sending a specially crafted request.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLCVE-2026-117561 · Other software · codefriar · reported by VulnCheckHigh 8.5
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user.
- Product
- sf-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to forceCVE-2026-116879 · Other software · SemanticMediaWiki · reported by VulnCheckMedium 6.9
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to trigger forced reparsing, semantic-store writes, and resource-intensive dependency work.
- Product
- SemanticMediaWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computCVE-2026-116878 · Other software · SemanticMediaWiki · reported by VulnCheckHigh 8.7
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requests with limit=0 to bypass the SQL LIMIT and trigger pairwise similar_text() comparisons, exhausting PHP CPU, memory, and database connections.
- Product
- SemanticMediaWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code.CVE-2026-107145 · Other software · alexandregz · reported by cvd@cert.plMedium 6.3
The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This issue was fixed in commit 4640889.
- Product
- twofactor_gauthenticator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order CVE-2026-102789 · Other software · balbooa.com · reported by security@joomla.orgCritical 9.3
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check.
- Product
- Gridbox extension for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The BMC does not correctly enforce integrity and encryption requirements for IPMI commands.CVE-2026-18450 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411Critical 9.8
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
- Product
- X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The BMC does not correctly enforce integrity and encryption requirements for IPMI commands.CVE-2026-18449 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411High 7.5
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
- Product
- X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations.CVE-2026-117469 · Other software · esaqa GmbH · reported by fdf66990-8419-4c8c-8848-ec15d75773b4Medium 5.4
Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner's file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits.
- Product
- Psono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code.CVE-2026-117468 · Other software · esaqa GmbH · reported by fdf66990-8419-4c8c-8848-ec15d75773b4Medium 6.5
Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.
- Product
- Psono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity.CVE-2026-77057 · Other software · boneIO · reported by cvd@cert.plLow 2.3
boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access to the device. This issue was fixed in version 1.6.0: web login attempts are rate-limited per source address and per account, panel passwords must be at least 8 characters long, and SSH allows three authentication attempts per connection with a shortened login grace time.
- Product
- boneIO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSCVE-2026-110314 · Other software · mtrudel · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbMedium 6.3
Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame. When a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handle_frame/3 and handle_info/3 never check that state, so later frames still reach handle_in/2 and later messages reach handle_info/2, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in init/1 after a failed token check could still run an admin-only action. This issue affects bandit: from 0.5.1 before 1.14.0.
- Product
- bandit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 26, 2026MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks.CVE-2026-116469 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 7.1
MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists. An attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the 'tlp' taxonomy with only 'tlp:clear' allowed, an event tagged 'TLP:AMBER' would not be recognized as belonging to the 'tlp' taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as 'Person' would not match a configured block entry of 'person', allowing the attribute to
- Product
- misp-guard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds.CVE-2026-116200 · Other software · grokability · reported by VulnCheckHigh 8.2
Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode aCVE-2026-116176 · Other software · vllm-project · reported by VulnCheckHigh 8.8
vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTCVE-2026-116166 · Other software · siyuan-note · reported by VulnCheckHigh 7.6
SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted CVE-2026-116071 · Other software · rotki · reported by VulnCheckHigh 8.2
rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.
- Product
- rotki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to forceCVE-2026-115810 · Other software · TandoorRecipes · reported by VulnCheckMedium 6.3
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file. Attackers can exploit the raw requests.get call in cookbook/integration/pestle.py, which bypasses the application's centralized requests-hardened SSRF filter, to reach internal-only endpoints, perform port/service discovery, and exfiltrate internal responses via the stored recipe image.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks.CVE-2026-106073 · Other software · nodejs · reported by support@hackerone.comLow 3.3
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.CVE-2026-106071 · Other software · nodejs · reported by support@hackerone.comLow 3.6
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043. This vulnerability affects Node.js **26.x**.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated useCVE-2026-111965 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.
- What to do
- Update the plugin to the newest version.
Oct 23, 2026Otter Blocks: Does not enforce its block visibility conditionsCVE-2026-109935 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
- Product
- Otter Blocks
- Fixed in
- 3.2.8
- What to do
- Update Otter Blocks to 3.2.8 or newer.
Oct 22, 2026Arista VeloCloud Orchestrator SQL Injection VulnerabilityCVE-2026-114625 · Other software · Arista · reported by psirt@arista.comExploitedCritical 9.4
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
- Product
- VeloCloud Orchestrator
- On CISA’s list since
- Oct 23, 2026 (federal fix deadline Oct 26, 2026)
- What to do
- Attackers are using this now. Install Arista’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogarista.comcisa.gov
Oct 22, 2026wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASCVE-2026-115388 · Other software · bytecodealliance · reported by VulnCheckMedium 6.9
wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies, so oversized writes succeed instead of trapping. A malicious guest can pass large buffers to write on outgoing-body resources, holding host allocations for the store's lifetime and exhausting host memory.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 22, 2026OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled.CVE-2026-115369 · Other software · openbao · reported by VulnCheckLow 2.1
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs.
- Product
- openbao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 22, 2026SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partCVE-2026-113874 · Other software · SmileCDR · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.6
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.
- Product
- HAPI FHIR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabhinavagarwal07.github.ioraw.githubusercontent.com
Oct 21, 2026Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing.CVE-2026-96398 · Websites & servers · reported by mlhess@drupal.orgMedium 4.3
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing.CVE-2026-96391 · Websites & servers · reported by mlhess@drupal.org
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing.CVE-2026-96386 · Websites & servers · reported by mlhess@drupal.orgMedium 6.5
Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing.CVE-2026-96384 · Websites & servers · reported by mlhess@drupal.orgLow 3.5
Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing.CVE-2026-96380 · Websites & servers · reported by mlhess@drupal.orgMedium 6.5
Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing.CVE-2026-96373 · Websites & servers · reported by mlhess@drupal.orgLow 3.3
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing.CVE-2026-96372 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing.CVE-2026-96366 · Websites & servers · reported by mlhess@drupal.orgMedium 5.3
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing.CVE-2026-96356 · Websites & servers · reported by mlhess@drupal.orgMedium 5.3
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing.CVE-2026-87955 · Websites & servers · reported by mlhess@drupal.orgMedium 4.3
Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing.CVE-2026-87954 · Websites & servers · reported by mlhess@drupal.orgMedium 4.3
Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.