Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
33,170 results · page 1 of 664
Oct 31, 2026Firelight Lightbox: Does not properly escape image attribute values before processing them in the browserCVE-2026-118438 · WordPress plugins & themes · reported by WPScan
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.
- Product
- Firelight Lightbox
- Fixed in
- 2.3.24
- What to do
- Update Firelight Lightbox to 2.3.24 or newer.
Oct 31, 2026BuddyForms: Does not properly verify ownership before deleting guest-uploaded attachmentsCVE-2026-118437 · WordPress plugins & themes · reported by WPScan
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
- Product
- BuddyForms
- Fixed in
- 2.10.1
- What to do
- Update BuddyForms to 2.10.1 or newer.
Oct 31, 2026Bulk Media Register: Does not properly validate a user-supplied path before moving a file on the serverCVE-2026-118043 · WordPress plugins & themes · reported by WPScan
The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.
- Product
- Bulk Media Register
- Fixed in
- 2.01
- What to do
- Update Bulk Media Register to 2.01 or newer.
Oct 31, 2026Payment Forms for Paystack: Does not properly restrict access to a page that displays its stored configurationCVE-2026-110042 · WordPress plugins & themes · reported by WPScan
The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration, allowing users with the Contributor role and above to view secret payment-gateway API credentials, both the live and test secret keys, which grant full access to the site owner's payment account.
- Product
- Payment Forms for Paystack
- Fixed in
- 4.0.6
- What to do
- Update Payment Forms for Paystack to 4.0.6 or newer.
Oct 30, 2026Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticatedCVE-2026-116755 · Other software · SoftIron · reported by 0a72a055-908d-47f5-a16a-1f09049c16c6High 7.4
Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access to the management plane to execute arbitrary operating system commands on hypervisor hosts as the privileged orchestration user. Attacker-controlled virtual machine template content (for example, the VM DESCRIPTION field) is delivered to hosts through a shell here-document whose terminator is not quoted, so shell expansion and here-document terminator injection are performed on that content during virtual machine lifecycle operations such as deploy, migrate, and network setup. Exploitation requires valid credentials, access to the management plane (owning a virtual machine alone is not sufficient), and a lifecycle operation that reaches the affected host. This issue affects the Orchestrator component of SoftIron HyperCloud from 1.0 through 2.6.17 and is fixed in 2.6.18.
- Product
- HyperCloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.softiron.cloud
Oct 30, 2026Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access controlCVE-2026-77152 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (host) entity. The access check for field collection items (field_collection_item_access()) granted edit and delete access to any user holding the "edit field collections" permission without verifying the user's access to the host entity. As a result, a user with "edit field collections" but without edit/update access to the host entity (for example a node they cannot edit) could edit or delete field collection items attached to that entity, bypassing the intended entity/node access restrictions. The fix requires access to the parent entity in addition to the field collection permission. This issue affects Field Collection for Drupal 7: version 7.x-1.0 up to and including 7.x-1.2.
- Product
- Field Collection for Drupal 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordd7es.tag1.comherodevs.com
Oct 30, 2026The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — inCVE-2026-111578 · WordPress plugins & themes · reported by WPScanHigh 7.5
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-slip documents, allowing unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.
- Fixed in
- 5.16.5
- What to do
- Update the plugin to 5.16.5 or newer.
Oct 30, 2026Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a TLS peer CVE-2026-117666 · Other software · deadtrickster · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbCritical 9.1
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. try_match_wildcard/4 in src/ssl_verify_hostname.erl anchors only the text before and after the * of an identifier such as f*.example.net, so the wildcard also consumes dots and the certificate is accepted for f.evil.example.net. RFC 6125 confines a wildcard to the left-most label. The same matcher lets *.168.1.1 match the IP literal 192.168.1.1. Whole-label wildcards are matched correctly. Erlang/OTP 20.0 and later check the hostname in ssl before a user verify_fun sees valid_peer, so a client that keeps server_name_indication set rejects the mismatch regardless. Exposed are clients that disable SNI, servers that verify client certificate hostnames with this library, and direct callers of verify_cert_hostname/2. This issue affects ssl_verify_fun: from 1.0.1 before 1.1.8.
- Product
- ssl_verify_fun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who contrCVE-2026-117645 · Other software · phoenixframework · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbMedium 5.3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributes_escape/1. attributes_escape/1 in lib/phoenix_html.ex escapes attribute values but not attribute names. key_escape/1 passes a binary key through html_escape, which neutralizes quotes and angle brackets but not whitespace, so a key such as x onmouseover ends the attribute and starts a new one. An atom key is only dasherized, so any character passes, including quotes and >. Nested data, aria and phx keys take the same paths. An application is affected when it builds attribute keys from untrusted input and renders them through HEEx <tag {@attrs}>, content_tag/3, or a direct call. Before 3.0.0 the same code lived in Phoenix.HTML.Tag. This issue affects phoenix_html: from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0.
- Product
- phoenix_html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 30, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-62121 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
- Product
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Affected
- up to 2.0.26
- What to do
- Affects up to 2.0.26. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Divi Contact Form 7: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-62057 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0.
- Product
- Divi Contact Form 7
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Divi Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026GIFTiT – Free Gifts for WooCommerce: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-52710 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT – Free Gifts for WooCommerce: from n/a through 4.5.
- Product
- GIFTiT – Free Gifts for WooCommerce
- Affected
- up to 4.5
- What to do
- Affects up to 4.5. Update GIFTiT – Free Gifts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Ultimate Addons for Elementor - Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39739 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5.
- Product
- Ultimate Addons for Elementor - Lite
- Affected
- up to 2.9.5
- What to do
- Affects up to 2.9.5. Update Ultimate Addons for Elementor - Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Media Player Addons for Elementor – Media Player widget for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-119365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player Addons for Elementor – Media Player widget for WP: from n/a through 1.1.10.
- Product
- Media Player Addons for Elementor – Media Player widget for WP
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update Media Player Addons for Elementor – Media Player widget for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticatCVE-2026-112816 · Other software · Canonical · reported by security@ubuntu.comCritical 10
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscourse.ubuntu.comdiscourse.ubuntu.com
Oct 30, 2026JetFormBuilder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-119479 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
- Product
- JetFormBuilder
- Affected
- up to 3.6.7.1
- What to do
- Affects up to 3.6.7.1. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-119369 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2.
- Product
- The Events Calendar
- Affected
- up to 6.18.2
- What to do
- Affects up to 6.18.2. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields.CVE-2026-118238 · Network & remote access · Tenda · reported by cret@cert.orgHigh 7.2
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.
- Product
- W18E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Blocksy Companion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65444 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This issue affects Blocksy Companion: from n/a through 2.1.60.
- Product
- Blocksy Companion
- Affected
- up to 2.1.60
- What to do
- Affects up to 2.1.60. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP).CVE-2026-119682 · Email & office · ManageEngine · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 7.9
An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the application, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Successful exploitation could allow an attacker to weaken authentication protections or cause a denial of service by configuring invalid MFA settings, potentially locking legitimate users out of the application. This vulnerability was fixed in build 4507. The reproduction explicitly uses build 4506.
- Product
- SharePoint Manager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.com
Oct 30, 2026A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding oCVE-2026-119680 · Email & office · ManageEngine · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 8.5
A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.
- Product
- SharePoint Manager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.com
Oct 30, 2026Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated ACVE-2026-119649 · Other software · OrchardCMS · reported by VulnCheckHigh 7.1
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().
- Product
- Orchard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-119370 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2.
- Product
- The Events Calendar
- Affected
- up to 6.18.2
- What to do
- Affects up to 6.18.2. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('InjectioCVE-2026-91915 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnCVE-2026-91913 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDBCVE-2026-119577 · Other software · ArcadeData · reported by VulnCheckHigh 7.6
ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.
- Product
- arcadedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 30, 2026OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability.CVE-2026-111498 · Other software · Dell · reported by security_alert@emc.comMedium 4.7
OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability.CVE-2026-91917 · Other software · Dell · reported by security_alert@emc.comHigh 8
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a deviceCVE-2026-75882 · Other software · ESET spol. s.r.o. · reported by security@eset.comHigh 8.5
An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests.
- Product
- ESET Endpoint Encryption
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilCVE-2026-111503 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attempts vulnerability.CVE-2026-111501 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Launch of phishing attacks.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive aCVE-2026-119416 · Other software · cakephp · reported by VulnCheckMedium 6.3
CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.
- Product
- cakephp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnCVE-2026-111505 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerabilitCVE-2026-111504 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnCVE-2026-101214 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability.CVE-2026-101213 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnCVE-2026-101210 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0).CVE-2026-64618 · Websites & servers · Apache Software Foundation · reported by security@apache.org
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.
- Product
- Apache Fineract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Oct 30, 2026A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges.CVE-2026-59386 · Other software · Cloud Foundry · reported by security@vmware.comMedium 6.5
A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.
- Product
- Cloud Foundry Controller (CAPI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a CVE-2026-115274 · Other software · elixir-lang · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbMedium 6.9
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication. This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
- Product
- elixir
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 30, 2026Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a deCVE-2026-109821 · Other software · elixir-lang · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbMedium 6.3
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted. This issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
- Product
- elixir
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS).CVE-2026-118576 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.
- Product
- Stage File Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS.CVE-2026-118575 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.
- Product
- Signature pad widget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS).CVE-2026-118560 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
- Product
- Commerce Stripe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof.CVE-2026-118559 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
- Product
- Commerce Stripe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS.CVE-2026-118553 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Product
- AI (Artificial Intelligence)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site ScriCVE-2026-118552 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Product
- AI (Artificial Intelligence)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site ScriCVE-2026-118549 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Product
- AI (Artificial Intelligence)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site ScriCVE-2026-118546 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Product
- AI (Artificial Intelligence)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site ScriCVE-2026-118545 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Product
- AI (Artificial Intelligence)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.